Document ID: chunk:federal_register_of_legislation:F2024C01109:reg:4:p19
Version: federal_register_of_legislation:F2024C01109
Segment Type: reg
Provision Reference: reg 4 (pt 19/34)
Character Range: 170833–173829

complied with the Market operator's obligations in this subrule and made a written attestation to that effect.
(2) The Market operator must comply with subrule (1) in a manner that is appropriate to:
(a)        the nature, complexity and risks of the Outsourcing Arrangement; and
(b)       the materiality of the Outsourcing Arrangement to the Market operator's Market Operations and Market Services.
(3) In determining for the purposes of subrule (1) whether the Service Provider has the ability and capacity to provide the services covered by the Outsourcing Arrangement effectively, the Market operator must take into account the extent to which the Service Provider is providing the same or similar services to other Market operators and Market Participants.
(4) A Market operator must give written notice to ASIC as soon as practicable after the Market operator enters into an Outsourcing Arrangement, and in any event no later than 20 business days after entering into the Outsourcing Arrangement.

Part 8A.4 Information security

8A.4.1 Information security
(1) A Market operator must have adequate arrangements to ensure the confidentiality, integrity and availability of information obtained, held or used by the Market operator in relation to its Market Operations and Market Services.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include:
(a)        arrangements to identify and document Information Assets that are integral to the provision of the Market operator's Market Operations and Market Services; and
(b)       controls, including automated controls, designed to prevent unauthorised access to Information Assets; and
(c)        controls for identifying, assessing, managing and monitoring for unauthorised access to Information Assets; and
(d)       arrangements designed to protect Information Assets from theft, loss or corruption.
(3) A Market operator must have adequate arrangements to ensure the availability of access to data obtained, held or used by the Market operator in its Market Operations and Market Services.
(4) Without limiting subrule (3), the arrangements referred to in that subrule must include arrangements designed to provide for the backup of the data and the timely recovery of the data in the event of any theft, corruption or loss of the data.
(5) A Market operator must notify ASIC in writing, as soon as possible and, in any case, no later than 72 hours, after becoming aware of any:
(a)        unauthorised access to or use of its Critical Business Services that impacts the effective operation or delivery of those services; or
(b)       unauthorised access to or use of market-sensitive, confidential or personal information.

Part 8A.5 Business Continuity Plans

8A.5.1 Business continuity
Business Continuity Plans
(1) A Market operator must establish, implement and maintain plans (Business Continuity Plans) for effectively responding to an event (Major Event) that would or would be likely to cause