Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p5
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 5/21)
Character Range: 43182–46168

environment that are being assessed or tested meet the requirements of the Act and these rules relevant to the kind of assurance assessment or systems testing being conducted.
Note: Applicants are required to conduct assurance assessments and systems testing for their application for accreditation (see subrule 2.3(3)). Accredited entities are required, in accordance with Chapter 6, to conduct assurance assessments and systems testing for annual reviews.
 (2) Each assurance assessment and systems testing must be conducted:
 (a) having regard to the requirements with which the accredited entity must comply as detailed in the entity's statement of scope and applicability; and
 (b) in respect of the entity's DI data environment,
as at the time the assurance assessment or systems testing is conducted.

3.2  Assessors
 (1) An assurance assessment and systems testing must be conducted by an individual (assessor):
 (a) who has appropriate experience, training and qualifications to conduct that kind of assessment or systems testing; and
 (b) if additional requirements relating to the assessor are specified in these rules for that kind of assurance assessment or systems testing—who meets those requirements.
 (2) If requested by the assessor, an accredited entity must take reasonable steps:
  (a) to permit the assessor to have secure online access to documentation and information relevant to the assurance assessment or systems testing; and
 (b) to undertake a site visit to the entity's premises or other location at which the accredited services are, or will be, provided.

Part 3.2—Assurance assessments

Division 1—Protective security assessment

3.3  Requirements
 (1) A protective security assessment must, in relation to an accredited entity:
 (a) review and assess the entity's:
 (i) implementation of, and compliance with, the controls in the protective security framework it uses, or will use if accredited;
 (ii) protective security capability;
 (iii) compliance with the additional protective security controls in Division 2 of Part 4.1 of Chapter 4, or ability to comply if accredited;
 (b) review and address the results of the penetration testing report referred to in rule 3.10;
 (c) review and address any findings or recommendations in the entity's report of its essential strategies review referred to in paragraph 3.4(2)(b); and
 (d) if the entity considers a control or strategy is not relevant to the entity—comply with the requirements of rule 3.5.
 (2) For a protective security assessment, the assessor conducting the assessment must, in addition to any requirements relating to assessors in the applicable protective security framework:
 (a)  be external to the accredited entity and, if the entity is part of a corporate group, external to the group; and
 (b) not be, or have been, involved in the design, implementation, operation or management of the accredited entity's DI data environment or accredited services.
 (3) For a protective security