{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_120"},"content":[{"type":"heading","attrs":{"id":"v0-p-2522","level":5},"content":[{"type":"text","text":"30CS","marks":[{"type":"bold"}]},{"type":"text","text":"  ","marks":[{"type":"bold"}]},{"type":"text","text":"Meaning of ","marks":[{"type":"bold"}]},{"type":"text","text":"evaluation report","marks":[{"type":"bold"},{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2523"},"content":[{"type":"text","text":" "},{"type":"text","text":" "},{"type":"text","text":"An "},{"type":"text","text":"evaluation report","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":", in relation to a cyber security exercise that was undertaken in relation to a system of national significance, is a written report:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2524"},"content":[{"type":"text","text":"if the exercise relates to all types of cyber security incidents—the purpose of which is to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2525"},"content":[{"type":"text","text":"evaluate the entity’s ability to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2526"},"content":[{"type":"text","text":"evaluate the entity’s preparedness to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(iii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2527"},"content":[{"type":"text","text":"evaluate the entity’s ability to mitigate the relevant impacts that all types of cyber security incidents could have on the system; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2528"},"content":[{"type":"text","text":"if the exercise relates to one or more specified types of cyber security incidents—the purpose of which is to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2529"},"content":[{"type":"text","text":"evaluate the entity’s ability to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2530"},"content":[{"type":"text","text":"evaluate the entity’s preparedness to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(iii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2531"},"content":[{"type":"text","text":"evaluate the entity’s ability to mitigate the relevant impacts that those types of cyber security incidents could have on the system; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2532"},"content":[{"type":"text","text":"that complies with such requirements (if any) as are specified in the rules."}]}]}]}]}]}]}]}