Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p6
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 6/21)
Character Range: 45919–49048

is part of a corporate group, external to the group; and
 (b) not be, or have been, involved in the design, implementation, operation or management of the accredited entity's DI data environment or accredited services.
 (3) For a protective security assessment involving ISO/IEC 27001, the assessor must also be accredited, or recognised, by the Joint Accreditation System of Australia and New Zealand to certify entities against ISO/IEC 27001.

3.4  Essential strategies review and report
 (1) In this rule:
Essential Eight Maturity Model and ISM Mapping document means the document titled 'Essential Eight Maturity Model and ISM Mapping' published by the ACSC.
Note: At the time these rules were made, located at https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model-ism-mapping.
Essential Eight Assessment Process Guide means the document titled 'Essential Eight Assessment Process Guide' published by the ACSC.
Note:  At the time these rules were made, located at https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-assessment-process-guide.
 (2) An accredited entity must:
 (a) review and assess its compliance with rule 4.19 by conducting an assessment of its implementation and compliance with the Essential Eight Maturity Model and ISM Mapping document for ISM controls marked maturity level 2 (essential strategies review); and
 (b) provide a report to the assessor (essential strategies report).
 (3) An essential strategies review must be conducted by a person who has appropriate experience, training and qualifications to conduct the review.
 (4) An essential strategies report must be in the form of the assessment report template in the Essential Eight Assessment Process Guide and must include the following information:
 (a) the opinion of the person conducting the review as to whether the accredited entity has implemented and complies with the maturity level 2 controls specified in the ISM;
 (b) if an accredited entity has implemented an alternative control in place of a control specified in the ISM—a description of that control and its effectiveness at mitigating the relevant cyber security risk; and
 (c) findings and any recommendations on the accredited entity's compliance with the Essential Eight Maturity Model and ISM Mapping document for ISM controls marked maturity level 2.

3.5  If a control or strategy is not relevant to an accredited entity
 (1) If an accredited entity considers that a particular protective security control in the framework it implements or strategy in rule 4.19 is not relevant to the entity, and has not or does not intend to implement that control or strategy, the entity must:
 (a) give the assessor a risk-based justification for the entity's decision that the control or strategy is not relevant;
 (b) give the assessor details of any other controls or risk strategies taken by the entity to mitigate any risk relevant to the control or strategy that is not relevant; and
 (c) ensure the assessor includes in the protective