Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p12
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 12/21)
Character Range: 62518–65315

a digital ID being compromised or otherwise rendered unreliable.
 (3) An accredited entity must take reasonable steps to prevent, detect and deal with cyber security incidents, including by:
 (a) having and maintaining protective security capability;
 (b) continuously improving its protective security capability; and
 (c) identifying, treating and managing cyber security risks.

Division 2—Protective security frameworks

4.2  Accredited entities must implement a security framework
  An accredited entity must implement, in respect of its accredited services and DI data environment, one of the following:
 (a) the PSPF, subject to the requirements in rule 4.3;
 (b) ISO/IEC 27001, subject to the requirements in rule 4.4;
 (c) an alternative framework, subject to the requirements in rule 4.5.

4.3  Compliance with the PSPF
 (1) If an accredited entity implements the PSPF for the purpose of rule 4.2, the entity must comply with, and manage and monitor, each of the controls specified in that framework that are listed in Schedule 5.
 (2) Subrule (1) applies subject to rule 4.6.
 (3) For the purposes of these rules:
 (a) the term 'sensitive information' used in the PSPF has the same meaning as 'personal information' in the Act;
 (b) the term 'Australian Government resources' used in the PSPF has the same meaning as 'DI data environment' in these rules;
 (c) the term 'risks' in the PSPF has the same meaning as 'cyber security risks' in these rules.
 (4) In Schedule 5:
B.1 and B.1 Core requirement, in relation to a particular policy of the PSPF, mean the core requirement designated 'B.1' in that policy.
B.2 Supporting requirement, in relation to a particular policy of the PSPF, means the supporting requirement designated 'B.2' in that policy.
PSPF Policy 1 means Policy 1 (Role of accountable authority) of the PSPF.
PSPF Policy 2 means Policy 2 (Management structures and responsibilities) of the PSPF.
PSPF Policy 3 means Policy 3 (Security planning and risk management) of the PSPF.
PSPF Policy 4 means Policy 4 (Security maturity monitoring) of the PSPF.
PSPF Policy 6 means Policy 6 (Security governance for contracted goods and service providers) of the PSPF.
PSPF Policy 8 means Policy 8 (Classification system) of the PSPF.
PSPF Policy 9 means Policy 9 (Access to information) of the PSPF.
PSPF Policy 11 means Policy 11 (Robust ICT systems) of the PSPF.
PSPF Policy 12 means Policy 12 (Eligibility and suitability of personnel) of the PSPF.
PSPF Policy 13 means Policy 13 (Ongoing assessment of personnel) of the PSPF.
PSPF Policy 14 means Policy 14 (Separating personnel) of the PSPF.
PSPF Policy 15 means Policy 15 (Physical security for entity resources) of the PSPF.
Senior Executive Service has the same meaning as in the Public Service Act 1999.
Note: At the time