Despite subsection 14(2) of the Legislation Act 2003, rules made for the purposes of section 30AH or 30AKA of this Act may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in a relevant document as in force or existing from time to time.
For the purposes of this section, relevant document means:
the document titled Essential Eight Maturity Model and published by the Australian Signals Directorate; or
the document titled Framework for Improving Critical Infrastructure Cybersecurity and published by the National Institute of Standards and Technology of the United States of America; or
the document titled Cybersecurity Capability Maturity Model and published by the Department of Energy of the United States of America; or
the document titled The 2020‑21 AESCSF Framework Core and published by Australian Energy Market Operator Limited (ACN 072 010 327); or
the document titled Cyber Supply Chain Risk Management and published by the Australian Signals Directorate; or
a document specified in the rules.
Subsection 13(3) of the Legislation Act 2003 does not apply to paragraph (2)(f) of this section.