Document ID: chunk:federal_register_of_legislation:F2025L00162:body:0:p9
Version: federal_register_of_legislation:F2025L00162
Segment Type: other
Provision Reference: 
Character Range: 22545–24407

at least on an annual basis, documented policies and procedures for the handling of sensitive or confidential information that ensure, as far as reasonably practicable that commercial information provided to it by Unaffiliated Entities is:
        (a)               handled as confidential information; and
        (b)               provided only to those with a need to know; and
        (c)               not used to advance the interests of the CS Service Provider or its Associated Entities.

2.4.5 External assurance report—Core Systems
(1) Before making material changes to its Core Systems, a Covered Licensee must engage an independent expert to conduct a review and prepare a written report (External Assurance report) about compliance with Rule 2.1.4 and paragraphs 2.3.1(2)(b) and (c), including the likely impact of the proposed material changes on compliance.
(2) The External Assurance report must be:
        (a)              completed no more than 120 days, and no less than 90 days, before each final decision by the board of the Covered Licensee to implement the material changes to its Core Systems; and
        (b)               provided to the board of the Covered Licensee as soon as reasonably practicable, and in any event no later than 5 days after the completion of the report; and
        (c)               provided to the representative body for feedback in accordance with Rule 2.1.2 as soon as reasonably practicable, and in any event no later than 5 days after the provision of the report to the board; and
        (d)               made publicly available as soon as reasonably practicable after it has been provided to the board, and in any event at least 30 days before the final decision of the board.
Note:  A Covered Licensee may apply to ASIC for an exemption from the requirements of this rule: see section 828R of the Act.