Document ID: chunk:federal_register_of_legislation:F2024C01108:reg:5:p12
Version: federal_register_of_legislation:F2024C01108
Segment Type: reg
Provision Reference: reg 5 (pt 12/35)
Character Range: 332717–335828

of the data.

(5) An Operator must notify ASIC in writing, as soon as possible and, in any case, no later than 72 hours, after becoming aware of any:
 1.         unauthorised access to or use of its Critical Business Services that impacts the effective operation or delivery of those services; or
 2.        unauthorised access to or use of market-sensitive, confidential or personal information.

Part 8A.5 Business Continuity Plans

8A.5.1 Business continuity

Business Continuity Plans

(1) An Operator must establish, implement and maintain plans (Business Continuity Plans) for effectively responding to an event (Major Event) that would or would be likely to cause significant disruption to the Operator's Market Operations or materially impact the Operator's Market Services.
Note: A Major Event may include the failure of or disruption to a Critical Business Service, including one operated by a Service Provider, or an event such as a pandemic or influenza event, natural disaster, cyber-attack or power failure.
(2) An Operator's Business Continuity Plans must be designed to enable:
(a)        continuity of the usual operation of the Operator's Critical Business Services, Market Operations and Market Services during a Major Event; and
(b)       to the extent continuation of the usual operation of the Operator's Critical Business Services, Market Operations and Market Services during a Major Event is not possible, timely and orderly restoration of those usual operations following the Major Event.
(3) An Operator's Business Continuity Plans must be appropriate to the nature, scale and complexity of the Operator's Critical Business Services, Market Operations and Market Services and to the Operator's structure and location.
(4) Without limiting subrules (1) to (3), the Operator's Business Continuity Plans must identify and address:
 1.         the types of Major Events that may impact the Operator's Critical Business Services, Market Operations and Market Services; and
 2.        activation procedures including trigger conditions for enacting the Operator's Business Continuity Plans; and
 3.         the potential impact Major Events may have on the Operator's Critical Business Services, Market Operations and Market Services; and
 4.        the classification of types of Major Events according to the potential severity of the impacts referred to in paragraph (c); and
 5.         escalation procedures that are appropriate to the classification referred to in paragraph (d); and
 6.         the actions, arrangements and resources required to achieve the outcomes referred to in subrule (2); and
Note: The actions, arrangements and resources covered by this paragraph would include key operational functions and processes, staff, alternate suppliers/service providers, technology, alternative premises and other physical infrastructure.
 1.        specific objectives for the time taken to achieve the outcomes referred to in paragraph (2)(b); and
 2.        procedures for communicating during a Major Event with persons that may be impacted by the Major Event, for the purposes