Document ID: chunk:federal_register_of_legislation:C2025C00045:section:30cw
Version: federal_register_of_legislation:C2025C00045
Segment Type: section
Provision Reference: s 30CW
Character Range: 191213–193358

30CW  Designated officers may undertake a vulnerability assessment

Scope
 (1) This section applies if:
 (a) an entity is the responsible entity for a system of national significance; and
 (b) either:
 (i) the Secretary has reasonable grounds to believe that if the entity were to be given a notice under subsection 30CU(1) or (2), the entity would not be capable of complying with the notice; or
 (ii) the entity has not complied with a notice given to the entity under subsection 30CU(1) or (2).

Request
 (2) The Secretary may give a designated officer a written request to:
 (a) undertake a vulnerability assessment in relation to:
 (i) the system; and
 (ii) all types of cyber security incidents; and
 (b) do so within the period specified in the request.
 (3) The Secretary may give a designated officer a written request to:
 (a) undertake a vulnerability assessment in relation to:
 (i) the system; and
 (ii) one or more specified types of cyber security incidents; and
 (b) do so within the period specified in the request.
 (4) Before giving a request under subsection (2) or (3) in relation to the system of national significance, the Secretary must consult:
 (a) the entity; and
 (b) if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.

Requirement
 (5) If a request under subsection (2) or (3) is given to a designated officer, the Secretary may, by written notice given to the entity, require the entity to do any or all of the following things:
 (a) provide the designated officer with access to premises for the purposes of undertaking the vulnerability assessment;
 (b) provide the designated officer with access to computers for the purposes of undertaking the vulnerability assessment;
 (c) provide the designated officer with reasonable assistance and facilities that are reasonably necessary to allow the designated officer to undertake the vulnerability assessment.

Notification of request
 (6) If a request under subsection (2) or (3) is given to a designated officer, the Secretary must give a copy of the request to the entity.