Document ID: chunk:federal_register_of_legislation:F2024C00177:body:0:p3
Version: federal_register_of_legislation:F2024C00177
Segment Type: other
Provision Reference: 
Character Range: 5485–8495

systems affecting provision of service or functioning of the asset.
(c) an interference with the critical infrastructure asset's operation technology or information communication technology essential to the functioning of the asset;
Example A Supervisory Control and Data Acquisition (SCADA) system.
(d) the storage, transmission or processing of sensitive operational information outside Australia, which includes:
 (i) layout diagrams;
 (ii) schematics;
 (iii) geospatial information;
 (iv) configuration information;
 (v) operational constraints or tolerances information;
 (vi) data that a reasonable person would consider to be confidential or sensitive about the asset;
(e) remote access to operational control or operational monitoring systems of the critical infrastructure asset.

8 Personnel hazards
       (1) For paragraph 30AH(1)(c) of the Act, for personnel hazards, a responsible entity must establish and maintain a process or system in a CIRMP:
(a) to permit a person unescorted access to a critical infrastructure asset mentioned in subsection 4(1) only where:
 (i) a background check of the person has been conducted in accordance with section 9; and
 (ii) a person has been found suitable to have unescorted access to the critical infrastructure asset in accordance with section 10; and
 (iii) an identity card has been issued to a person who meets the requirements in subparagraphs (i) and (ii); and
(b) to collect the identity and contact information for each person who has access to the critical infrastructure asset; and
(c) to record the date, time and duration of access to the critical infrastructure asset by each person; and
(d) as far as it is reasonably practicable to do so—to minimise or eliminate material risks:
 (i) arising from a malicious or negligent person; and
 (ii) arising from the off-boarding process for outgoing employees and contractors.
       (2) For subsection 30AH(12) of the Act, the establishment and maintenance of processes or systems mentioned in subsection (1) is taken to be action that mitigates the relevant impact of personnel hazards on the critical infrastructure asset.

9 Background checks
       (1) A background check is required:
(a) before a person is granted unescorted access to the critical infrastructure asset; and
(b) if the person requires ongoing access to the critical infrastructure asset—every 2 years.
       (2) For paragraph 30AH(4)(a) of the Act, a background check of a person must be conducted under the AusCheck scheme.
       (3) A background check must include an assessment of information relating to the matters mentioned in paragraphs 5(a), (b), (c) and (d) of the AusCheck Act; and
(a) for paragraph 30H(4)(c) of the Act—the criteria against which the information must be assessed are the criminal history criteria; and
(b) for paragraph 30AH(4)(d) of the Act—the assessment must consist of both an electronic identity verification check and an in person identity verification check.
       (4) A responsible entity