Document ID: chunk:federal_register_of_legislation:F2024C01108:reg:5:p8
Version: federal_register_of_legislation:F2024C01108
Segment Type: reg
Provision Reference: reg 5 (pt 8/35)
Character Range: 321211–324347

technology, including software, hardware and data (both soft and hard copy).

Major Event has the meaning given by Rule 8A.5.1.

Market Operations, in relation to an Operator, means the operations, activities and conduct of the Operator's Market or CGS Market (as the case may be) or of the Operator in connection with that Market or CGS Market.

Market Services, in relation to an Operator, means the services, data and associated products provided by the Operator in connection with the Operator's Market or CGS Market (as the case may be).

Operator means an operator referred to in paragraph 8A.1.1(a) or (b).

Outsourcing Arrangement means an arrangement between an Operator and another person (Service Provider) under which the Service Provider will provide, operate or support one or more of the Operator's Critical Business Services.

Participant means a Participant of a Market referred to in paragraph 8A.1.1(a) or of a CGS Market.

Service Provider has the meaning given in the definition of Outsourcing Arrangement.

Part 8A.2 Trading controls

8A.2.1 Operator to have trading controls

An Operator must have controls, including automated controls, that enable immediate suspension, limitation or prohibition of the entry by a Participant of Trading Messages where required for the purposes of ensuring the Market or CGS Market (as the case may be) is fair, orderly and transparent.

Part 8A.3 Critical Business Services

8A.3.1 Resilience, reliability, integrity and security

Adequate arrangements
(1) An Operator must have adequate arrangements (Critical Business Services Arrangements) to ensure the resilience, reliability, integrity and security of its Critical Business Services.
Note: Arrangements referred to in subrule (1) would generally include, but are not limited to, policies, procedures and organisational resources including financial, human and technological resources.
(2) Without limiting subrule (1), an Operator's Critical Business Services Arrangements must include arrangements for:
(a)        identifying Critical Business Services; and
(b)       identifying, assessing, managing and monitoring for any risks to the resilience, reliability, integrity and security of Critical Business Services; and
(c)        ensuring Critical Business Services have sufficient and scalable capacity for ongoing and planned Market Operations and Market Services; and
(d)       preventing unauthorised access to or use of Critical Business Services; and
(e)        managing the implementation of new Critical Business Services and of changes to existing Critical Business Services in accordance with Rule 8A.3.2; and
(f)        dealing with a Major Event in accordance with Part 8A.5 of these Rules; and
(g)       managing Outsourcing Arrangements in relation to Critical Business Services in accordance with Rule 8A.3.3.

Review and change of arrangements
(3) An Operator must undertake a review of its Critical Business Services Arrangements:

(a)        following each material change to its Critical Business Services; and

(b)       at least once every 12 months,

and apply recommended changes to the Critical