Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p18
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 18/21)
Character Range: 78327–81399

for cloud services.
 (2) An accredited entity must have and maintain a register of cloud service providers whose services it uses which includes the following information:
 (a) the cloud services provider's name and cloud service name;
 (b) the entity's purpose for using the cloud services;
 (c) the type of personal information collected, used, held or disclosed by the cloud services provider (if any);
 (d) the date for the next protective security assurance assessment of the cloud services;
 (e) contractual arrangements for the use of the cloud service by the entity; and
 (f) contact details for the cloud service provider, including emergency contact details.
Note:  If the entity implements ISO/IEC 27001, this rule would be met by the entity complying with clause 5.23 of Annex A of ISO/IEC 27001.

Subdivision C—Incident detection, investigation, response and reporting

4.15  Incident monitoring and detection
 (1) An accredited entity must implement and maintain appropriate mechanisms for:
 (a) preventing and detecting actual and suspected cyber security incidents; and
 (b) alerting the entity's personnel to actual or suspected cyber security incidents.
 (2) Without limiting subrule (1), the mechanisms must include an accessible process for personnel, individuals, enforcement bodies and other entities to report actual or suspected cyber security incidents to the accredited entity on a confidential basis.

4.16  Incident investigation, management and response
 (1) An accredited entity must implement and maintain mechanisms for investigating and dealing with cyber security incidents which relate to the accredited entity's DI data environment.
 (2) An accredited entity must investigate cyber security incidents and suspected cyber security incidents unless the incident or suspected incident has been referred to, and has been accepted by, the ACSC or an enforcement body.
 (3) Without limiting subrule (1), the mechanisms must include processes and procedures to:
 (a) manage and respond to cyber security incidents and suspected cyber security incidents;
 (b) for an ISP:
 (i) identify any digital ID that has been affected by a cyber security incident; and
 (ii) suspend and prevent use of the digital ID; and
 (c) for an ASP:
 (i) identify any special attributes that have been affected by a cyber security incident; and
 (ii) suspend and prevent use of the special attribute.

4.17  Disaster recovery and business continuity management
 (1) An accredited entity must have, maintain and comply with a disaster recovery and business continuity plan for its DI data environment that covers:
 (a) business continuity governance;
 (b) training requirements for members of the entity's personnel who perform recovery tasks such as backup recovery and restoration;
 (c) recovery objectives and priorities;
 (d) backup retention and protection from loss processes;
 (e) backup recovery and restoration processes;
 (f) continuity strategies; and
 (g) testing requirements for restoration procedures.
 (2) The disaster recovery and business continuity