If:
an entity is the responsible entity for a system of national significance; and
the entity has adopted an incident response plan that applies to the entity;
the entity must comply with:
the incident response plan; or
if the plan has been varied on one or more occasions—the plan as varied.
Civil penalty: 200 penalty units.