Contents
- AusCheck Act 2007
- Criminal Code Act 1995
- Security of Critical Infrastructure Act 2018
- Part 2A Critical infrastructure risk management programs
- Part 2AA Reporting obligations relating to certain assets that are not covered by a critical infrastructure risk management program
- Part 2C Enhanced cyber security obligations
- Part 6A Declaration of systems of national significance by the Minister
30CURequirement to undertake vulnerability assessment#
(1)The Secretary may, by written notice given to an entity that is the responsible entity for a system of national significance, require the entity to:
(a)undertake, or cause to be undertaken, a vulnerability assessment in relation to:
(i)the system; and
(ii)all types of cyber security incidents; and
(b)do so within the period specified in the notice.
(2)The Secretary may, by written notice given to an entity that is the responsible entity for a system of national significance, require the entity to:
(a)undertake, or cause to be undertaken, a vulnerability assessment in relation to:
(i)the system; and
(ii)one or more specified types of cyber security incidents; and
(b)do so within the period specified in the notice.
(3)In deciding whether to give a notice to an entity under subsection (1) or (2), the Secretary must have regard to:
(a)the costs that are likely to be incurred by the entity in complying with the notice; and
(b)the reasonableness and proportionality of the requirement in the notice; and
(c)such other matters (if any) as the Secretary considers relevant.
(4)Before giving a notice to an entity under subsection (1) or (2) in relation to the system of national significance, the Secretary must consult:
(a)the entity; and
(b)if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.
Sourced from the Federal Register of Legislation at legislation.gov.au, © Commonwealth of Australia, licensed under CC BY 4.0. Compilations may have been reformatted.