Document ID: chunk:federal_register_of_legislation:F2024C01108:reg:5:p15
Version: federal_register_of_legislation:F2024C01108
Segment Type: reg
Provision Reference: reg 5 (pt 15/35)
Character Range: 341170–344368

one or more of the Participant's Critical Business Services.

Participant means a participant referred to in paragraph 8B.1.1(a) or (b).

Participant Operations, in relation to a Participant, means the operations, activities or conduct of the Participant in connection with the Markets and CGS Markets of which it is a Participant.

Participant Services, in relation to a Participant, means the services provided by the Participant in connection with the Markets and CGS Markets of which it is a Participant.

Service Provider: has the meaning given in the definition of Outsourcing Arrangement.

Part 8B.2 Critical Business Services

8B.2.1 Resilience, reliability, integrity and security

Adequate arrangements
(1) A Participant must have adequate arrangements (Critical Business Services Arrangements) to ensure the resilience, reliability, integrity and security of its Critical Business Services.
Note: Arrangements referred to in subrule (1) would generally include, but are not limited to, policies, procedures and organisational resources including financial, human and technological resources.
(2) Without limiting subrule (1), a Participant's Critical Business Services Arrangements must include arrangements for:
(a)        identifying Critical Business Services; and
(b)       identifying, assessing, managing and monitoring for any risks to the resilience, reliability, integrity and security of Critical Business Services; and
(c)        ensuring Critical Business Services have sufficient and scalable capacity for the Participant's ongoing and planned Participant Operations and Participant Services; and
(d)       preventing unauthorised access to or use of Critical Business Services; and
(e)        managing the implementation of new Critical Business Services and of changes to existing Critical Business Services in accordance with Rule 8B.2.2; and
(f)        dealing with a Major Event in accordance with Part 8B.4 of these Rules; and
(g)       managing Outsourcing Arrangements in relation to Critical Business Services in accordance with Rule 8B.2.3.

Review and change of arrangements
(3) A Participant must undertake a review of its Critical Business Services Arrangements:
(a)        following each material change to its Critical Business Services; and
(b)       at least once every 12 months,

and apply recommended changes to the Critical Business Services Arrangements arising from the review to ensure they comply with subrules (1) and (2).

Documentation of arrangements
(4) A Participant must document:
 1.         its Critical Business Services Arrangements; and
 2.        the scope and results of each review performed in accordance with subrule (3); and
 3.         any changes applied to the Critical Business Services Arrangements as result of a review or otherwise,

and must maintain that documentation for a period of at least seven years from the later of the date it is created or the date it is last amended.

8B.2.2 Change management for Critical Business Services

(1) A Participant must have adequate arrangements to ensure that its Critical Business Services Arrangements continue to comply with subrule 8B.2.1(1) following the implementation of a