Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p3
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 3/21)
Character Range: 37917–40856

not necessary; and
 (vii) details of consultation with relevant stakeholders.
 (3) The applicant must respond in writing to the findings of the privacy impact assessment.
 (4) The applicant's response to the privacy impact assessment must be signed by the applicant's accountable executive.
 (5) For each risk or recommendation identified by the privacy impact assessment, the applicant must:
 (a) develop a risk matrix based on an established risk management framework or standard;
 (b) conduct a risk assessment;
 (c) assign a risk rating in accordance with the risk matrix developed in accordance with paragraph (a);
 (d) respond to each risk identified in the report with actions it will take to address the risk; and
 (e) respond to each recommendation in the assessment.
 (6) The applicant's response to each risk needing to be addressed and each recommendation must include:
 (a) for each risk or recommendation that the applicant will address:
 (i) details of the action the applicant will take to address the risk or recommendation;
 (ii) the timeframe in which the applicant will complete the action, having regard to the risk rating assigned for the risk or recommendation; and
 (iii) the residual risk rating expected following completion of the action; and
 (b) for each risk and recommendation that the applicant will not address:
 (i) the reasons for the applicant's decision not to address the risk;
 (ii) details of alternative actions, if any, to be taken by the applicant; and
 (iii) the residual risk rating expected following completion of any alternative action.

2.5  Technical testing
 (1) The applicant must, at the time it applies for accreditation, have conducted technical testing in accordance with this rule.
 (2) The technical testing of the information technology system through which the applicant will provide its accredited services must determine whether the system has the functionality necessary to meet the following requirements:
 (a) incident monitoring, detection, investigation, management and response for cyber security incidents as required by Subdivision C of Division 3 of Part 4.1 of Chapter 4;
 (b) logging requirements as required by rule 4.20;
 (c) incident monitoring, detection, investigation, management and response for fraud incidents as required by Division D of Part 4.2 of Chapter 4;
 (d) support to individuals as required by rules 4.11 and 4.30;
 (e) data minimisation requirements, as required by subrule 4.42(2); and
 (f) compliance with the Accreditation Data Standards that are specific to the kind of accredited services the applicant will provide if accredited.
 (3) The applicant must record in respect of the technical testing conducted:
 (a) the test completion criteria used;
 (b) the assumptions, limitations and dependencies used;
 (c) the methodology used, including a description of the data and environment used to conduct the testing;
 (d) how each test maps to