Document ID: chunk:federal_register_of_legislation:F2024C01258:schedule:2:p3
Version: federal_register_of_legislation:F2024C01258
Segment Type: schedule
Provision Reference: sch 2 (pt 3/6)
Character Range: 350962–355592

report to senior management the results of any testing that identifies design, implementation or operational deficiencies in information security controls relevant to its CDR data environment.
 (4) The accredited data recipient must ensure that testing is conducted by appropriately skilled persons who are independent from the performance of controls over the CDR data environment.
 (5) The accredited data recipient must review the sufficiency of its testing program referred to in subclause (1):
 (a) when there is a material change to the nature and extent of threats to its CDR data environment or to the boundaries of its CDR data environment—as soon as practicable; or
 (b) where no such material changes occur—at least annually.

1.7  Step 5—Manage and report security incidents
 (1) An accredited data recipient must have procedures and practices in place to detect, record, and respond to information security incidents as soon as practicable.
 (2) The accredited data recipient must create and maintain plans to respond to information security incidents that it considers could plausibly occur (CDR data security response plans).
 (3) The accredited data recipient's CDR data security response plans must include procedures for:
 (a) managing all relevant stages of an incident, from detection to post‑incident review; and
 (b) notifying CDR data security breaches to the Information Commissioner and to CDR consumers as required under Part IIIC of the Privacy Act 1988; and
 (c) notifying information security incidents to the Australian Cyber Security Centre as soon as practicable and in any case no later than 30 days after the accredited data recipient becomes aware of the security incident.
Note: For paragraph (3)(b), see section 56ES of the Act for the extended application of Part IIIC of the Privacy Act 1988.
 (4) The accredited data recipient must review and test its CDR data security response plans:
 (a) when there is a material change to the nature and extent of threats to its CDR data environment or to the boundaries of its CDR data environment—as soon as practicable; and
 (b) where no such material changes occur—at least annually.
 (5) In this clause:
Australian Cyber Security Centre means the cyber security function within the Australian Signals Directorate.

Part 2—Minimum information security controls

2.1  Purpose of Part
  This Part sets out the information security controls, for the purposes of paragraph 1.5(1)(a) of this Schedule.

2.2  Information security controls
  The information security controls are set out in the following table:

     Control requirements                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Minimum controls                                   Description of minimum controls
(1)  An accredited data recipient must have processes in place to limit the risk of inappropriate or unauthorised access to its CDR data environment.                                            (a)                                                                                                                                                                                                                                                                                                                                                                                                    Multi‑factor authentication or equivalent control  Multi‑factor authentication or equivalent control is required for all access to CDR data.
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           Note:       This