Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p13
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 13/21)
Character Range: 65080–67898

means Policy 14 (Separating personnel) of the PSPF.
PSPF Policy 15 means Policy 15 (Physical security for entity resources) of the PSPF.
Senior Executive Service has the same meaning as in the Public Service Act 1999.
Note: At the time these rules were made, all policies comprising the PSPF were located at https://www.protectivesecurity.gov.au/.

4.4  Compliance with ISO/IEC 27001
 (1) If an accredited entity implements ISO/IEC 27001 for the purpose of subrule 4.2, the entity must comply with, and manage and monitor, all the controls specified in that standard.
 (2) Subrule (1) applies subject to rule 4.6.
 (3) For the purposes of these rules:
 (a) the term 'Personally Identifiable Information' used in ISO/IEC 27001 has the same meaning as 'personal information' in the Act;
 (b) the term 'information security incident' used in ISO/IEC 27001 has the same meaning as 'cyber security incident' in the Act; and
 (c) the term 'information security risk' used in ISO/IEC 27001 has the same meaning as 'cyber security risk' in these rules.

4.5  Implementation and compliance with an alternative framework
 (1) An accredited entity may only implement an alternative framework if the entity demonstrates, in accordance with subrule (2) or (3), that the entity complies with all the same kinds of controls that would be required by either:
 (a) rule 4.3, if the entity were to implement the PSPF for the purpose of rule 4.2; or
 (b) rule 4.4, if the entity were to implement ISO/IEC 27001 for the purpose of rule 4.2.
 (2) To demonstrate that the accredited entity complies with all the same kinds of controls as the PSPF for the purpose of paragraph (1)(a), the accredited entity must prepare and maintain an up-to-date document that:
 (a) maps all the controls specified in the alternative framework that must be complied with against the corresponding controls mentioned in rule 4.3; and
 (b) if the alternative framework does not require compliance with a particular kind of control mentioned in rule 4.3—specifies the relevant control mentioned in that rule.
 (3) To demonstrate that the accredited entity complies with all the same kinds of controls as ISO/IEC 27001 for the purpose of paragraph (1)(b), the accredited entity must prepare and maintain an up-to-date document that:
 (a) maps all the controls specified in the alternative framework that must be complied with against the corresponding controls mentioned in rule 4.4; and
 (b) if the alternative framework does not require compliance with a particular kind of control mentioned in rule 4.4—specifies the relevant control mentioned in that rule.
 (4) If an accredited entity implements an alternative framework for the purposes of rule 4.2, the entity must:
 (a) continue to comply with, and manage and monitor:
 (i) all the controls specified in