Document ID: chunk:federal_register_of_legislation:F2024C01109:reg:4:p26
Version: federal_register_of_legislation:F2024C01109
Segment Type: reg
Provision Reference: reg 4 (pt 26/34)
Character Range: 190659–193806

held or used by the Market Participant in relation to its Participant Operations and Participant Services.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include:
(a)        arrangements to identify and document Information Assets that are integral to the provision of the Market Participant's Participant Operations and Participant Services; and
(b)       controls, including automated controls, designed to prevent unauthorised access to Information Assets; and
(c)        controls for identifying, assessing, managing and monitoring for unauthorised access to Information Assets; and
(d)       arrangements designed to protect Information Assets from theft, loss or corruption.
(3) A Market Participant must have adequate arrangements to ensure the availability of access to data obtained, held or used by the Market Participant in its Participant Operations and Participant Services.
(4) Without limiting subrule (3), the arrangements referred to in that subrule must include arrangements designed to provide for the backup of the data and the timely recovery of the data in the event of any theft, corruption or loss of the data.
(5) A Market Participant must maintain, for a period of at least seven years after the relevant event, records of any:
(a)        unauthorised access to or use of its Critical Business Services that impacts the effective operation or delivery of those services; or
(b)       unauthorised access to or use of market-sensitive, confidential or personal information.

Part 8B.4 Business Continuity Plans

8B.4.1 Business continuity
Business Continuity Plans
(1) A Market Participant must establish, implement and maintain plans (Business Continuity Plans) for effectively responding to an event (Major Event) that would or would be likely to cause significant disruption to the Market Participant's Participant Operations or materially impact the Market Participant's Participant Services.
Note: A Major Event may include the failure of a Critical Business Service, including one operated by a Service Provider, or an event such as a pandemic or influenza event, natural disaster, cyber-attack or power failure.
(2) A Market Participant's Business Continuity Plans must be designed to enable:
(a)        continuity of the usual operation of the Market Participant's Critical Business Services, Participant Operations and Participant Services during a Major Event; and
(b)       to the extent continuation of the usual operation of the Market Participant's Critical Business Services, Participant Operations and Participant Services during a Major Event is not possible, timely and orderly restoration of those usual operations following the Major Event.
(3) A Market Participant's Business Continuity Plans must be appropriate to the nature, scale and complexity of the Market Participant's Critical Business Services, Participant Operations and Participant Services and to the Market Participant's structure and location.
(4) Without limiting subrules (1) to (3), the Market Participant's Business Continuity Plans must identify and address:
(a)        the type of Major Events