Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p14
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 14/21)
Character Range: 67653–70499

the relevant control mentioned in that rule.
 (4) If an accredited entity implements an alternative framework for the purposes of rule 4.2, the entity must:
 (a) continue to comply with, and manage and monitor:
 (i) all the controls specified in that framework; and
 (ii) any controls specified in the document prepared and maintained in accordance with paragraph (2)(b) or (3)(b); and
 (b) comply with a new version of the alternative framework within the timeframe specified for that version.
 (5) For the purpose of paragraph (4)(b), if a new version of the framework does not specify a timeframe for compliance, the timeframe for compliance is taken to be 12 months.
 (6) Subrule (4) applies subject to rule 4.6.

4.6  If a control is not relevant to an entity
  An accredited entity is not required to comply with a particular control in the framework it implements if the most recent report of the assessor conducting the protective security assessment for the entity includes the assessor's opinion that the control is not relevant to the entity because of the entity's particular circumstances.
Note: See rule 3.5 about an assessor's opinion that a control is not relevant to an entity.
Example: A control about managing a cloud service provider will not be relevant to an entity if the entity does not use a cloud service provider when providing its accredited services.

Division 3—Additional protective security controls

4.7  Cyber security risk assessment
 (1) An accredited entity must, for each reporting period, conduct an assessment of the cyber security risks associated with its accredited services and DI data environment (cyber security risk assessment).
 (2) The accredited entity must:
 (a) develop a risk matrix based on an established risk management framework or standard; and
 (b) as part of the cyber security risk assessment:
 (i) assess the entity's cyber security risks in accordance with the risk matrix developed in accordance with paragraph (a);
 (ii) record the results of the assessment;
 (iii) determine and record the entity's level of tolerance to cyber security risks; and
 (iv) record how the entity's controls for cyber security risks are applied to its accredited services and DI data environment.
 (3) If an ISP collects, uses, holds, discloses or destroys biometric information, the ISP must assess and record in its cyber security risk assessment the security risks, mitigation strategies and any other actions the ISP will take to address risks related to biometric information.

Applicants
 (4) If subrule (1) applies to an applicant because of rule 2.3, the words 'for each reporting period' appearing in that subrule are to be ignored.

4.8  Sharing information about risks
  An accredited entity must:
 (a) consider the implications that the entity's decisions related to the management of cyber