Document ID: chunk:federal_register_of_legislation:C2024A00100:clause:1_3
Version: federal_register_of_legislation:C2024A00100
Segment Type: clause
Provision Reference: sch 1 cl 3
Character Range: 7805–9348

3  At the end of section 9
Add:

Data storage systems
 (7) If, under this section, an asset is a critical infrastructure asset, then a data storage system in respect of which all of the following requirements are satisfied is taken to be part of the critical infrastructure asset:
 (a) the responsible entity for the critical infrastructure asset owns or operates the data storage system;
 (b) the data storage system is used, or is to be used, in connection with the critical infrastructure asset;
 (c) business critical data is stored, or is processed in or by, the data storage system (whether or not other information is also stored, or is processed in or by, the data storage system);
 (d) for a hazard where there is a material risk that the occurrence of the hazard could have an impact on the data storage system, there is also a material risk that the occurrence of the hazard could have a relevant impact on the critical infrastructure asset.
Note: The effect of this subsection is, for example, that:
(a) obligations under Part 2 in relation to a critical infrastructure asset will also need to take into account the data storage system; and
(b) a critical infrastructure risk management program under Part 2A in relation to a critical infrastructure asset will also need to cover the data storage system; and
(c) notification obligations under Part 2B of cyber security incidents relating to any relevant impact on a critical infrastructure asset will also need to take into account any relevant impact on the data storage system.