Document ID: chunk:federal_register_of_legislation:F2021L01392:clause:6_22:p1
Version: federal_register_of_legislation:F2021L01392
Segment Type: clause
Provision Reference: sch 6 cl 22 (pt 1/3)
Character Range: 83142–90176

22  Schedule 2, table in clause 2.2
Substitute:

     Control requirements                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Minimum controls                                   Description of minimum controls
(1)  An accredited data recipient must have processes in place to limit the risk of inappropriate or unauthorised access to its CDR data environment.                                            (a)                                                                                                                                                                                                                                                                                                                                                                                                    Multi-factor authentication or equivalent control  Multi-factor authentication or equivalent control is required for all access to CDR data.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Note:       This minimum control does not apply to access to CDR data by CDR consumers.

(b)  Restrict administrative privileges                                                                                                                                                          Administrative privileges are granted only on an as needs basis for users to perform their duties and only for the period they are required for.
                                                                                                                                                                                                 Privileges granted on an ongoing basis are regularly reviewed to confirm their ongoing need.

(c)  Audit logging and monitoring                                                                                                                                                                Critical events are identified, logged and retained to help ensure traceability and accountability of actions. These logs are reviewed regularly to identify irregularities and deviations from expected processing.
                                                                                                                                                                                                 Note: In relation to retention, see paragraph 9.3(2)(l) of these rules.

(d)  Access security                                                                                                                                                                             Processes, including automatic processes, are implemented to limit unauthorised access to the CDR data environment. At the minimum these include:
                                                                                                                                                                                                 (a) provision and timely revocation for users who no longer need access; and
                                                                                                                                                                                                 (b) monitoring and review of the appropriateness of user access privileges on at least a quarterly basis.

(e)  Limit physical access                                                                                                                                                                       Physical access to facilities where CDR data is stored, hosted or accessed (including server rooms, communications rooms, and premises of business operation) is restricted to authorised individuals.

(f)  Role based access                                                                                                                                                                           Role‑based access is implemented to limit user access rights to only that necessary for personnel to perform their assigned responsibilities. Role‑based access is assigned in accordance with the principle of least necessary privileges and segregation of duties.

(g)  Unique IDs                                                                                                                                                                                  Use of generic, shared and/or default accounts is restricted to those necessary to run a service or a system. Where generic, shared and/or default accounts are used, actions performed using these accounts are monitored and logs are retained.
                                                                                                                                                                                                 Note: In relation to retention, see paragraph 9.3(2)(l) of these rules.

(h)  Password authentication                                                                                                                                                                     Strong authentication mechanisms are enforced prior to allowing users to access systems within the CDR data environment, including, but not limited to, general security requirements relating to password complexity, account lockout, password history, and password ageing.

(i)  Encryption in transit                                                                                                                                                                       Implement robust network security controls to help protect data in transit, including: encrypting data in transit and authenticating access to data in accordance with the data standards (if any) and industry best practice, implementing processes to audit data access and use, and implementing processes to verify the identity of communications.

(2)  An accredited data recipient of CDR data must take steps to secure their network and systems within the