{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_106"},"content":[{"type":"heading","attrs":{"id":"v0-p-2364","level":5},"content":[{"type":"text","text":"30CD","marks":[{"type":"bold"}]},{"type":"text","text":"  ","marks":[{"type":"bold"}]},{"type":"text","text":"Responsible entity must have an incident response plan","marks":[{"type":"bold"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2365"},"content":[{"type":"text","text":" "},{"type":"text","text":" "},{"type":"text","text":"If:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2366"},"content":[{"type":"text","text":"an entity is the responsible entity for a system of national significance; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2367"},"content":[{"type":"text","text":"the statutory incident response planning obligations apply to the entity in relation to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2368"},"content":[{"type":"text","text":"the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2369"},"content":[{"type":"text","text":"cyber security incidents;"}]}]}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-2370"},"content":[{"type":"text","text":"the entity must:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2371"},"content":[{"type":"text","text":"adopt; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2372"},"content":[{"type":"text","text":"maintain;"}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-2373"},"content":[{"type":"text","text":"an incident response plan that applies to the entity in relation to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(e)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2374"},"content":[{"type":"text","text":"the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(f)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2375"},"content":[{"type":"text","text":"cyber security incidents."}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-2376"},"content":[{"type":"text","text":"Civil penalty:"},{"type":"text","text":" "},{"type":"text","text":"200 penalty units."}]}]}]}]}]}