Document ID: chunk:federal_register_of_legislation:F2023L00112:reg:5:p1
Version: federal_register_of_legislation:F2023L00112
Segment Type: reg
Provision Reference: reg 5 (pt 1/3)
Character Range: 8889–11815

5     The 2020‑21 AESCSF Framework Core published by Australian Energy Market Operator Limited (ACN 072 010 327)                                                     Meet Security Profile 1 as indicated in the document

Note Sections 30AN and 30ANA of the Act provide for the incorporation of the documents mentioned in this subsection as in force from time to time.
       (5) A responsible entity must establish and maintain a process or system in the entity's CIRMP to comply with a framework that is equivalent to a framework in a document mentioned in subsection (4), including any conditions.
       (6) For subsections 30AKA(1), (3) and (5) of the Act, a responsible entity must have regard to whether the entity's CIRMP describes the cyber and information security hazards that could have a relevant impact on the asset.

9 Personnel hazards
       (1) For paragraph 30AH(1)(c) of the Act, for personnel hazards, a responsible entity must establish and maintain a process or system in the entity's CIRMP:
(a) to identify the entity's critical workers; and
(b) to permit a critical worker access to critical components of the CI asset only where the critical worker has been assessed to be suitable to have such access; and
(c) as far as it is reasonably practicable to do so—to minimise or eliminate the following material risks:
 (i) arising from malicious or negligent employees or contractors; and
 (ii) arising from the off-boarding process for outgoing employees and contractors.
       (2) For paragraph (1)(b) and paragraph 30AH(4)(a) of the Act, the process or system for assessing the suitability of a critical worker may be a background check conducted under the AusCheck scheme.
Note Responsible entities are not required to use the AusCheck scheme to assess the suitability of critical workers. It is open for responsible entities to use other measures to assess the suitability of critical workers. That process or system must be included in the CIRMP.
       (3) If a CIRMP permits a background check to be conducted under subsection (2), the background check must include assessment of information relating to the matters mentioned in paragraphs 5(a), (b), (c) and (d) of the AusCheck Act; and
(a) for paragraph 30AH(4)(c) of the Act—the criteria against which the information must be assessed are the criminal history criteria; and
(b) for paragraph 30AH(4)(d) of the Act—the assessment must consist of both an electronic identity verification check and an in person identity verification check.
       (4) A responsible entity must notify the Secretary if a background check is no longer required for a critical worker.
       (5) In making a suitability assessment mentioned in paragraph (1)(b), a responsible entity must consider the following:
(a) any advice from the Secretary under the following provisions of the AusCheck Regulations:
 (i) paragraph 21DA(2)(a);
 (ii) paragraph 21DA(2)(b);
 (iii)