Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p19
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 19/21)
Character Range: 81083–84066

backup recovery and restoration;
 (c) recovery objectives and priorities;
 (d) backup retention and protection from loss processes;
 (e) backup recovery and restoration processes;
 (f) continuity strategies; and
 (g) testing requirements for restoration procedures.
 (2) The disaster recovery and business continuity plan for the accredited entity's DI data environment must be separate from any other plans in respect of its other business or organisational functions.
 (3) An accredited entity must, at least once in each reporting period, review and test its disaster recovery and business continuity plan.
Note:  If the entity implements ISO/IEC 27001, this rule would be met by the entity complying with clauses 5.30 and 8.13 of ISO/IEC 27001.

4.18  Record keeping
 (1) This rule applies to cyber security incidents that cause, or are likely to cause, serious harm to one or more individuals.
 (2) An accredited entity must prepare and keep records of:
 (a) any decisions to use civil, administrative or disciplinary procedures, or to take no further action, in response to a cyber security incident; and
 (b) the entity's investigations of and responses to a cyber security incident.
 (3) For each reporting period, an accredited entity must prepare a report detailing, in respect of any accredited services provided by the accredited entity in a digital ID system other than the Australian Government Digital ID System, the following:
 (a) the number of cyber security incidents that occurred in the reporting period in relation to the entity's accredited services and DI data environment (if any); and
 (b) for each incident:
 (i) the date and time of the incident;
 (ii) a description of the type of incident;
 (iii) the number of digital IDs affected (if any); and
 (iv) the severity of the incident; and
 (c) a description of the measures taken by the entity in response to the incidents covered by the report.
 (4) Subject to rule 7.8, a record required by this rule must:
 (a) be retained for a minimum of 3 years from the day it was generated; and
 (b) not contain biometric information.

Subdivision D—Information technology system controls

4.19  Essential Eight
 (1) Subject to subrule (2), an accredited entity must, in relation to its DI data environment, implement and comply with all mitigation strategies whose 'relative security effectiveness rating' is marked 'essential' in the document titled Strategies to Mitigate Cyber Security Incidents published by the ACSC.
Note:  At the time these rules were made, located at https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/strategies-mitigate-cyber-security-incidents.
 (2) An accredited entity is not required to comply with a mitigation strategy specified in subrule (1) if the most recent report of an assessor conducting a protective security assessment for the accredited entity includes the assessor's opinion that the strategy is not relevant to the entity because of the