Document ID: chunk:federal_register_of_legislation:F2023L00112:reg:5:p2
Version: federal_register_of_legislation:F2023L00112
Segment Type: reg
Provision Reference: reg 5 (pt 2/3)
Character Range: 11516–14366

critical worker.
       (5) In making a suitability assessment mentioned in paragraph (1)(b), a responsible entity must consider the following:
(a) any advice from the Secretary under the following provisions of the AusCheck Regulations:
 (i) paragraph 21DA(2)(a);
 (ii) paragraph 21DA(2)(b);
 (iii) subsection 21DA(4);
 (iv) subsection 21DA(5); and
(b) whether permitting a critical worker to have access to critical components of the CI asset would be prejudicial to security; and
(c) any other information that may affect the person's suitability to have access to the critical components of the CI asset.
Note A responsible entity may be required to inform the Secretary of a decision to grant or revoke access to a critical infrastructure asset, in certain circumstances—see AusCheck Regulations, section 21ZA.
       (6) For subsections 30AKA(1), (3) and (5) of the Act, a responsible entity must have regard:
(a) to whether the CIRMP lists the entity's critical workers; and
(b) to whether the CIRMP describes the personnel risks, the occurrence of which could have a relevant impact on the asset.

10 Supply chain hazards
     (1)         For paragraph 30AH(1)(c) of the Act, for supply chain hazards, a responsible entity must establish and maintain in the entity's CIRMP a process or system to:
(a) as far as it is reasonably practicable to do so—minimise or eliminate the following material risks:
 (i) unauthorised access, interference or exploitation of the asset's supply chain; and
 (ii) misuse of privileged access to the asset by any provider in the supply chain; and
 (iii) disruption of the asset due to an issue in the supply chain; and
 (iv) arising from threats to people, assets, equipment, products, services, distribution and intellectual property within supply chains; and
 (v) arising from major suppliers; and
 (vi) any failure or lowered capacity of other assets and entities in the entity's supply chain; and
(b) as far as it is reasonably practicable to do so—mitigate the relevant impact of a supply chain hazard on the asset.
       (2) For subsections 30AKA(1), (3) and (5) of the Act, a responsible entity must have regard:
(a) to whether the CIRMP lists the entity's major suppliers; and
(b) to whether the CIRMP describes the supply chain hazards, which could have a relevant impact on the asset.

11 Physical security hazards and natural hazards
       (1) For paragraph 30AH(1)(c) of the Act, for physical security hazards and natural hazards, a responsible entity must establish and maintain a process or system in the entity's CIRMP:
(a) to identify the physical critical components of the CI asset; and
(b) as far as it is reasonably practicable to do so—to minimise or eliminate a material risk, and mitigate a relevant impact, of:
 (i) a physical security hazard on a physical critical component; and
 (ii)