Document ID: chunk:federal_register_of_legislation:F2024C01108:reg:5:p18
Version: federal_register_of_legislation:F2024C01108
Segment Type: reg
Provision Reference: reg 5 (pt 18/35)
Character Range: 350016–353177

ability and capacity to provide the services covered by the Outsourcing Arrangement effectively, the Participant must take into account the extent to which the Service Provider is providing the same or similar services to other Participants.

Part 8B.3 Information security

8B.3.1 Information security
(1) A Participant must have adequate arrangements to ensure the confidentiality, integrity and availability of information obtained, held or used by the Participant in relation to its Participant Operations and Participant Services.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include:
 1.         arrangements to identify and document Information Assets that are integral to the provision of the Participant's Participant Operations and Participant Services; and
 2.        controls, including automated controls, designed to prevent unauthorised access to Information Assets; and
 3.         controls for identifying, assessing, managing and monitoring for unauthorised access to Information Assets; and
 4.        arrangements designed to protect Information Assets from theft, loss or corruption.
(3) A Participant must have adequate arrangements to ensure the availability of access to data obtained, held or used by the Participant in its Participant Operations and Participant Services.
(4) Without limiting subrule (3), the arrangements referred to in that subrule must include arrangements designed to provide for the backup of the data and the timely recovery of the data in the event of any theft, corruption or loss of the data.
(5) A Participant must maintain, for a period of at least seven years after the relevant event, records of any:
 1.         unauthorised access to or use of its Critical Business Services that impacts the effective operation or delivery of those services; or
 2.        unauthorised access to or use of market-sensitive, confidential or personal information.

Part 8B.4 Business Continuity Plans

8B.4.1 Business continuity

Business Continuity Plans
(1) A Participant must establish, implement and maintain plans (Business Continuity Plans) for effectively responding to an event (Major Event) that would or would be likely to cause significant disruption to the Participant's Participant Operations or materially impact the Participant's Participant Services.
Note: A Major Event may include the failure of a Critical Business Service, including one operated by a Service Provider, or an event such as a pandemic or influenza event, natural disaster, cyber-attack or power failure.

(2) A Participant's Business Continuity Plans must be designed to enable:
 1.         continuity of the usual operation of the Participant's Critical Business Services, Participant Operations and Participant Services during a Major Event; and
 2.        to the extent continuation of the usual operation of the Participant's Critical Business Services, Participant Operations and Participant Services during a Major Event is not possible, timely and orderly restoration of those usual operations following the Major Event.

(3) A Participant's Business Continuity Plans must be appropriate to