Document ID: chunk:federal_register_of_legislation:F2024C01258:schedule:2:p1
Version: federal_register_of_legislation:F2024C01258
Segment Type: schedule
Provision Reference: sch 2 (pt 1/6)
Character Range: 345634–348641

Schedule 2—Steps for privacy safeguard 12—security of CDR data held by accredited data recipients

Part 1—Steps for privacy safeguard 12

1.1  Purpose of Part
  This Part sets out steps for the purposes of subsection 56EO(1) of the Act, which relate to privacy safeguard 12 (see rule 7.11 and paragraph 5.12(1)(a) of these rules).
Note: An accredited data recipient must take the steps set out in this Schedule to protect CDR data from misuse, interference and loss, and unauthorised access, modification or disclosure, under subsection 56EO(1) of the Act. Subsection 56EO(1) is a civil penalty provision (see section 56EU of the Act).

1.2  Interpretation
  In this Schedule:
CDR data environment means the information technology systems used for, and processes that relate to, the management of CDR data.
information security capability, of an accredited data recipient:
 (a) means the accredited data recipient's ability to manage the security of its CDR data environment in practice through the implementation and operation of processes and controls; and
 (b) includes the accredited data recipient being able to allocate adequate budget and resources, and provide for management oversight.
senior management, of an accredited data recipient that is a body corporate, means:
 (a) the accredited data recipient's directors; and
 (b) any person who is an associated person, within the meaning of paragraph (a) of the definition of that term, of the accredited data recipient.

1.3  Step 1—Define and implement security governance in relation to CDR data
 (1) An accredited data recipient of CDR data must establish a formal governance framework for managing information security risks relating to CDR data setting out the policies, processes, roles and responsibilities required to facilitate the oversight and management of information security.
 (2) The accredited data recipient must clearly document its practices and procedures relating to information security and management of CDR data, including the specific responsibilities of senior management.
 (3) The accredited data recipient must have and maintain an information security policy that details:
 (a) its information security risk posture setting out the exposure and potential for harm to the accredited data recipient's information assets, including CDR data that it holds, from security threats; and
 (b) how its information security practices and procedures, and its information security controls, are designed, implemented and operated to mitigate those risks.
 (4) The accredited data recipient must review and update the framework for appropriateness:
 (a) in response to material changes to both the extent and nature of threats to its CDR data environment and its operating environment; or
 (b) where no such material changes occur—at least annually.

1.4  Step 2—Define the boundaries of the CDR data environment
 (1) An accredited data recipient must assess, define and document the boundaries of its CDR data environment.
 (2) The