Document ID: chunk:federal_register_of_legislation:F2024C01108:reg:5:p11
Version: federal_register_of_legislation:F2024C01108
Segment Type: reg
Provision Reference: reg 5 (pt 11/35)
Character Range: 329964–332942

request, access books, records and other information of the Service Provider relating to the Critical Business Services; and
 2.        ensure that ASIC has the same access to all books, records and other information relating to the Critical Business Services and maintained by the Service Provider, that ASIC would have if not for the Outsourcing Arrangement; and
 3.        ensure that for each Outsourcing Arrangement, the Operator's Board or a director or senior manager have confirmed that they have complied with the Operator's obligations in this subrule and made a written attestation to that effect.

(2) The Operator must comply with subrule (1) in a manner that is appropriate to:
 1.         the nature, complexity and risks of the Outsourcing Arrangement; and
 2.        the materiality of the Outsourcing Arrangement to the Operator's Market Operations and Market Services.
     (3) In determining for the purposes of subrule (1) whether the Service Provider has the ability and capacity to provide the services covered by the Outsourcing Arrangement effectively, the Operator must take into account the extent to which the Service Provider is providing the same or similar services to other Operators and Participants.

(4) An Operator must give written notice to ASIC as soon as practicable after the Operator enters into an Outsourcing Arrangement, and in any event no later than 20 business days after entering into the Outsourcing Arrangement.

Part 8A.4 Information security

8A.4.1 Information security

(1) An Operator must have adequate arrangements to ensure the confidentiality, integrity and availability of information obtained, held or used by the Operator in relation to its Market Operations and Market Services.

(2) Without limiting subrule (1), the arrangements referred to in that subrule must include:
 1.         arrangements to identify and document Information Assets that are integral to the provision of the Operator's Market Operations and Market Services; and
 2.        controls, including automated controls, designed to prevent unauthorised access to Information Assets; and
 3.         controls for identifying, assessing, managing and monitoring for unauthorised access to Information Assets; and
 4.        arrangements designed to protect Information Assets from theft, loss or corruption.

(3) An Operator must have adequate arrangements to ensure the availability of access to data obtained, held or used by the Operator in its Market Operations and Market Services.

(4) Without limiting subrule (3), the arrangements referred to in that subrule must include arrangements designed to provide for the backup of the data and the timely recovery of the data in the event of any theft, corruption or loss of the data.

(5) An Operator must notify ASIC in writing, as soon as possible and, in any case, no later than 72 hours, after becoming aware of any:
 1.         unauthorised access to or use of its Critical Business Services