Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p7
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 7/21)
Character Range: 48812–51770

relevant;
 (b) give the assessor details of any other controls or risk strategies taken by the entity to mitigate any risk relevant to the control or strategy that is not relevant; and
 (c) ensure the assessor includes in the protective security assessment, the assessor's opinion as to:
 (i) the extent, if any, of risk or residual risk as a result of not implementing the requirement;
 (ii) the appropriateness of controls or risk mitigation strategies taken by the entity to mitigate any cyber security risks that the protective security control or strategy is intended to mitigate; and
 (iii) whether the entity's decision that a particular control or strategy is not relevant to it is appropriate.
Example:  A control involving physical security may not be relevant to an entity because the entity's personnel work remotely and the entity does not have a physical office.
 (2) If the assessor does not agree that the control or strategy is not relevant to the accredited entity, the control must be implemented.
Division 2—Fraud assessment

3.6  Requirements
 (1) A fraud assessment must review and assess:
 (a) an accredited entity's implementation and compliance with the fraud control requirements in Part 4.2 of Chapter 4; and
 (b) whether the entity's fraud processes are sufficient to respond to emerging risks and threats to its DI data environment.
 (2) An assessor conducting a fraud assessment must:
 (a) be external to the accredited entity and, if the entity is part of a corporate group, external to the group; and
 (b) not be, or have been, involved in the design, implementation, operation or management of the accredited entity's DI data environment or accredited services.

Division 3—Accessibility and useability assessment

3.7  Requirements
 (1) This Division applies for the purposes of subsection 30(1) of the Act.
 (2) An accessibility and useability assessment must, in relation to an accredited entity, review and assess:
 (a) the entity's compliance with subsection 30(1AA) of the Act;
 (b) the entity's implementation and compliance with rule 4.49;
 (c) for an ISP—the entity's implementation and compliance with the additional accessibility and useability requirements in Division 4 of Part 5.1 of Chapter 5;
 (d) the findings of the WCAG testing, including actions that will address any risks and recommendations identified in the assessor's report of the WCAG testing; and
 (e) if the entity is required to conduct useability testing—the findings of the useability testing, including actions that will address any risks and recommendations identified in the assessor's report of the useability testing.

Part 3.3—Systems testing

Division 1—Penetration testing

3.8  Penetration testing requirements
 (1) Penetration testing must evaluate the effectiveness of the implementation of security controls in the information technology system through which the accredited entity provides, or will provide, its accredited services