{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_119"},"content":[{"type":"heading","attrs":{"id":"v0-p-2492","level":5},"content":[{"type":"text","text":"30CR","marks":[{"type":"bold"}]},{"type":"text","text":"  ","marks":[{"type":"bold"}]},{"type":"text","text":"External evaluation report","marks":[{"type":"bold"}]}]},{"type":"heading","attrs":{"id":"v0-p-2493","level":6},"content":[{"type":"text","text":"Scope","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(1)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2494"},"content":[{"type":"text","text":"This section applies if an entity has undertaken a cyber security exercise under section"},{"type":"text","text":" "},{"type":"text","text":"30CM, and:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2495"},"content":[{"type":"text","text":"all of the following conditions are satisfied:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2496"},"content":[{"type":"text","text":"the entity has prepared, or purported to prepare, an evaluation report under section"},{"type":"text","text":" "},{"type":"text","text":"30CQ relating to the exercise;"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2497"},"content":[{"type":"text","text":"the entity has given a copy of the report to the Secretary;"}]}]},{"type":"legalListItem","attrs":{"marker":"(iii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2498"},"content":[{"type":"text","text":"the Secretary has reasonable grounds to believe that the report was not prepared appropriately; or"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2499"},"content":[{"type":"text","text":"the entity has contravened section"},{"type":"text","text":" "},{"type":"text","text":"30CQ."}]}]}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2500","level":6},"content":[{"type":"text","text":"Requirement","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(2)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2501"},"content":[{"type":"text","text":"The Secretary may, by written notice given to the entity, require the entity to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2502"},"content":[{"type":"text","text":"appoint an external auditor; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2503"},"content":[{"type":"text","text":"arrange for the external auditor to prepare an evaluation report (the "},{"type":"text","text":"new evaluation report","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":") relating to the exercise; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2504"},"content":[{"type":"text","text":"arrange for the external auditor to give the new evaluation report to the entity; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2505"},"content":[{"type":"text","text":"give the Secretary a copy of the new evaluation report within:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2506"},"content":[{"type":"text","text":"the period specified in the notice; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2507"},"content":[{"type":"text","text":"if the Secretary allows a longer period—that longer period."}]}]}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(3)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2508"},"content":[{"type":"text","text":"The notice must specify:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2509"},"content":[{"type":"text","text":"the matters to be covered by the new evaluation report; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2510"},"content":[{"type":"text","text":"the form of the new evaluation report and the kinds of details it is to contain."}]}]}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2511","level":6},"content":[{"type":"text","text":"Consultation","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(4)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2512"},"content":[{"type":"text","text":"Before giving a notice to an entity under this section in connection with a cyber security exercise that relates to a system of national significance, the Secretary must consult:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2513"},"content":[{"type":"text","text":"the entity; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2514"},"content":[{"type":"text","text":"if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator."}]}]}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2515","level":6},"content":[{"type":"text","text":"Eligibility for appointment as an external auditor","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(5)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2516"},"content":[{"type":"text","text":"An individual is not eligible to be appointed as an external auditor by the entity if the individual is an officer, employee or agent of the entity."}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2517","level":6},"content":[{"type":"text","text":"Compliance","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(6)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2518"},"content":[{"type":"text","text":"An entity must comply with a requirement under subsection"},{"type":"text","text":" "},{"type":"text","text":"(2)."}]},{"type":"paragraph","attrs":{"id":"v0-p-2519"},"content":[{"type":"text","text":"Civil penalty:"},{"type":"text","text":" "},{"type":"text","text":"200 penalty units."}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2520","level":6},"content":[{"type":"text","text":"Immunity","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(7)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2521"},"content":[{"type":"text","text":"The new evaluation report is not admissible in evidence against the entity in civil proceedings relating to a contravention of a civil penalty provision of this Act (other than subsection"},{"type":"text","text":" "},{"type":"text","text":"(6))."}]}]}]}]}]}