Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p11
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 11/21)
Character Range: 59873–62811

the findings of each assessor's report (entity's response) as required by this rule.
 (2) The accredited entity's response to an assessor's report must be signed by the entity's accountable executive.
 (3) For each risk and recommendation identified in an assessor's report, the accredited entity must:
 (a) develop a risk matrix based on an established risk management framework or standard;
 (b) conduct a risk assessment;
 (c) assign a risk rating in accordance with the risk matrix developed in accordance with paragraph (a);
 (d) respond to each risk identified in the report with actions it will take to address the risk; and
 (e) respond to each recommendation in the report.
 (4) The accredited entity's response to each risk needing to be addressed and each recommendation must include:
 (a) for each risk or recommendation that the entity will address:
 (i) details of the action the entity will take to address the risk or recommendation;
 (ii) the timeframe in which the entity will complete the action, having regard to the risk rating assigned for the risk or recommendation; and
 (iii) the residual risk rating expected following completion of the action; and
 (b) for each risk or recommendation that the entity will not address:
 (i) the reasons for the entity's decision not to address the risk;
 (ii) details of alternative actions, if any, to be taken by the entity and the timeframes to do so; and
 (iii) the residual risk rating expected following completion of any alternative action.

Chapter 4—Requirements for maintaining accreditation

Part 4.1—Protective security controls

Division 1—Capability

4.1  Protective security capability
 (1) Protective security capability of an accredited entity means the accredited entity's ability to manage the protective security of its DI data environment through the implementation and operation of processes and controls, including by:
 (a) allocating adequate budget and resources; and
  (b) providing for management oversight.
 (2) An accredited entity's protective security capability must be appropriate and adapted to respond to cyber security risks, including emerging risks, having regard to:
 (a) the extent and nature of the personal information the entity holds;
 (b) the extent and nature of cyber security risks, threats and vulnerabilities;
 (c) the potential loss or damage to one or more individuals if a cyber security incident were to occur;
 (d) the potential loss or damage to relying parties if a cyber security incident were to occur; and
 (e) the potential loss or damage to entities and individuals if a cyber security incident were to occur and result in a digital ID being compromised or otherwise rendered unreliable.
 (3) An accredited entity must take reasonable steps to prevent, detect and deal with cyber security incidents, including by:
 (a) having and maintaining protective security capability;
 (b) continuously improving its protective