30CJ  Incident response plan

• (1)

  An incident response plan is a written plan:

  • (a)

    that applies to an entity that is the responsible entity for a system of national significance; and

  • (b)

    that relates to the system; and

  • (c)

    that relates to cyber security incidents; and

  • (d)

    the purpose of which is to plan for responding to cyber security incidents that could have a relevant impact on the system; and

  • (e)

    that complies with such requirements (if any) as are specified in the rules.

• (2)

  Requirements specified under paragraph (1)(e):

  • (a)

    may be of general application; or

  • (b)

    may relate to one or more specified systems of national significance; or

  • (c)

    may relate to one or more specified types of cyber security incidents.

  Note: For specification by class, see subsection 13(3) of the Legislation Act 2003.

• (3)

  Subsection (2) of this section does not, by implication, limit subsection 33(3A) of the Acts Interpretation Act 1901.