Document ID: chunk:federal_register_of_legislation:F2023L00112:front:0:p3
Version: federal_register_of_legislation:F2023L00112
Segment Type: other
Provision Reference: 
Character Range: 5531–8232

consider to be confidential or sensitive about the asset;
(e) remote access to operational control or operational monitoring systems of the CI asset.

7 General—all hazards
       (1) For paragraph 30AH(1)(c) of the Act, a responsible entity must establish and maintain a process or system in the entity's CIRMP:
(a) to identify the operational context of the CI asset; and
(b) to identify the material risks to the CI asset; and
(c) as far as it is reasonably practicable to do so:
 (i) to minimise or eliminate the material risks, which may include those mentioned in section 6; and
 (ii) to mitigate the relevant impact of each hazard on the CI asset; and
(d) to review the CIRMP to ensure compliance with section 30AE of the Act; and
(e) to keep the CIRMP current to ensure it complies with section 30AF of the Act.
       (2) For subsections 30AKA(1), (3) and (5) of the Act, a responsible entity must have regard to whether the entity's CIRMP:
(a) describes the outcome of the process or system mentioned in paragraph (1)(a);
(b) describes interdependencies between the entity's CI asset and other CI assets;

(c) identifies each position within the entity:
 (i) that is responsible for developing and implementing the CIRMP; and
 (ii) for the processes mentioned in paragraph (1)(d)—that is responsible for reviewing the CIRMP or keeping the CIRMP up to date;
(d) contains the contact details for the positions described under paragraph (c);
(e) contains a risk management methodology;
(f) describes the circumstances in which the entity will review the CIRMP.

8 Cyber and information security hazards
       (1) For paragraph 30AH(1)(c) of the Act, subsections (2) and (3) specify requirements for cyber and information security hazards.
       (2) A responsible entity must establish and maintain a process or system in the CIRMP to—as far as it is reasonably practicable to do so:
(a) minimise or eliminate any material risk of a cyber and information security hazard occurring; and
(b) mitigate the relevant impact of a cyber and information security hazard on the CI asset.
       (3) Within 12 months after the end of the applicable period mentioned in subsection 4(2), a responsible entity must comply with subsection (4) or (5).
       (4) A responsible entity must establish and maintain a process or system in the CIRMP to:
(a) comply with a framework contained in a document mentioned in the following table as in force from time to time; and
(b) meet any conditions mentioned in the table for the document.
Item  Document                                                                                                                                                       Condition