Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p17
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 17/21)
Character Range: 75656–78588

becomes aware of any breach of a requirement specified in its system security plan; or
 (iii) any change in the entity's organisational structure or control, functions or activities, if that change will, or is reasonably likely to, increase the level of cyber security risk.
 (2) The entity's review of its system security plan must, at a minimum:
 (a) have regard to any significant shifts in the entity's cyber security risk, threat and operating environment;
 (b) include an assessment of the appropriateness of the existing protective cyber security control measures and mitigation controls; and
 (c) review and, if necessary, update the goals and strategic objectives in the entity's system security plan, including:
 (i) recording whether each goal and strategic objective has been met; and
 (ii) updating the goals and strategic objectives for the next year.
Note: If the entity implements the ISO/IEC 27001, subrule (2) would be met by the entity complying with clauses 8, 9 and 10 of ISO/IEC 27001.
 (3) As soon as practicable after the entity has completed each review of its system security plan, the entity must make all necessary amendments to its system security plan.

Subdivision B—Cloud service management

4.14  Selection, use and management of cloud services
 (1) If an accredited entity uses cloud services as part of its DI data environment, it must have and maintain a cloud services management plan that includes policies and processes for:
 (a) the selection, use, and management of cloud services;
 (b) defining and recording all protective security controls and strategies that must be complied with in accordance with the Act, these rules and the Accreditation Data Standards in relation to the entity's use of cloud services;
 (c) periodic penetration testing and assurance assessments for the effectiveness of the protective security controls and strategies mentioned in paragraph (b), including in relation to:
 (i) geographic location;
 (ii) management of privileged access; and
 (iii) effective destruction of data;
 (d) responding to cyber security incidents or suspected cyber security incidents involving cloud services;
 (e) the orderly migration of information to and from cloud services;
 (f) monitoring, reviewing and evaluating the ongoing use of cloud services to manage cyber security risks;
 (g) if personal information is to be collected, held, used or disclosed using cloud services;
 (i) how that information will be collected, held, used or disclosed; and
 (ii) how personal information will be destroyed once it is no longer required; and
 (h) amending or discontinuing the use of cloud services, including exit strategies for cloud services.
 (2) An accredited entity must have and maintain a register of cloud service providers whose services it uses which includes the following information:
 (a) the cloud services provider's name and cloud service name;
 (b) the entity's purpose