Document ID: chunk:federal_register_of_legislation:C2021A00124:clause:1_35ab:p2
Version: federal_register_of_legislation:C2021A00124
Segment Type: clause
Provision Reference: sch 1 cl 35AB (pt 2/3)
Character Range: 94093–96940

the Minister is satisfied that the directions that could be authorised by the Ministerial authorisation are likely to facilitate a practical and effective response to the incident.

Action directions
 (7) The Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d) unless the Minister is satisfied that:
 (a) the specified entity is unwilling or unable to take all reasonable steps to respond to the incident; and
 (b) the specified direction is reasonably necessary for the purposes of responding to the incident; and
 (c) the specified direction is a proportionate response to the incident; and
 (d) compliance with the specified direction is technically feasible.
Note: Section 12P provides examples of responding to a cyber security incident.
 (8) In determining whether the specified direction is a proportionate response to the incident, the Minister must have regard to:
 (a) the impact of the specified direction on:
 (i) the activities carried on by the specified entity; and
 (ii) the functioning of the asset concerned; and
 (b) the consequences of compliance with the specified direction; and
 (c) such other matters (if any) as the Minister considers relevant.
 (9) The Minister must not give a Ministerial authorisation under paragraph (2)(c) or (d) if the specified direction:
 (a) requires the specified entity to permit the authorised agency to do an act or thing that could be the subject of a request under section 35AX; or
 (b) requires the specified entity to take offensive cyber action against a person who is directly or indirectly responsible for the incident.

Intervention requests
 (10) The Minister must not give a Ministerial authorisation under paragraph (2)(e) or (f) unless the Minister is satisfied that:
 (a) giving a Ministerial authorisation under paragraph (2)(c) or (d) would not amount to a practical and effective response to the incident; and
 (b) if there is only one relevant entity for the asset concerned—the relevant entity is unwilling or unable to take all reasonable steps to respond to the incident; and
 (c) if there are 2 or more relevant entities for the asset concerned—those entities, when considered together, are unwilling or unable to take all reasonable steps to respond to the incident; and
 (d) the specified request is reasonably necessary for the purposes of responding to the incident; and
 (e) the specified request is a proportionate response to the incident; and
 (f) compliance with the specified request is technically feasible; and
 (g) each of the acts or things specified in the specified request is an act or thing of a kind covered by section 35AC.
Note: Section 12P provides examples of responding to a cyber security incident.
 (11) In determining whether the specified request is a proportionate response to the incident, the Minister must have