{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_125"},"content":[{"type":"heading","attrs":{"id":"v0-p-2559","level":5},"content":[{"type":"text","text":"30CW","marks":[{"type":"bold"}]},{"type":"text","text":"  ","marks":[{"type":"bold"}]},{"type":"text","text":"Designated officers may undertake a vulnerability assessment","marks":[{"type":"bold"}]}]},{"type":"heading","attrs":{"id":"v0-p-2560","level":6},"content":[{"type":"text","text":"Scope","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(1)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2561"},"content":[{"type":"text","text":"This section applies if:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2562"},"content":[{"type":"text","text":"an entity is the responsible entity for a system of national significance; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2563"},"content":[{"type":"text","text":"either:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2564"},"content":[{"type":"text","text":"the Secretary has reasonable grounds to believe that if the entity were to be given a notice under subsection"},{"type":"text","text":" "},{"type":"text","text":"30CU(1) or (2), the entity would not be capable of complying with the notice; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2565"},"content":[{"type":"text","text":"the entity has not complied with a notice given to the entity under subsection"},{"type":"text","text":" "},{"type":"text","text":"30CU(1) or (2)."}]}]}]}]}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2566","level":6},"content":[{"type":"text","text":"Request","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(2)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2567"},"content":[{"type":"text","text":"The Secretary may give a designated officer a written request to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2568"},"content":[{"type":"text","text":"undertake a vulnerability assessment in relation to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2569"},"content":[{"type":"text","text":"the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2570"},"content":[{"type":"text","text":"all types of cyber security incidents; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2571"},"content":[{"type":"text","text":"do so within the period specified in the request."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(3)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2572"},"content":[{"type":"text","text":"The Secretary may give a designated officer a written request to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2573"},"content":[{"type":"text","text":"undertake a vulnerability assessment in relation to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2574"},"content":[{"type":"text","text":"the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2575"},"content":[{"type":"text","text":"one or more specified types of cyber security incidents; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2576"},"content":[{"type":"text","text":"do so within the period specified in the request."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(4)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2577"},"content":[{"type":"text","text":"Before giving a request under subsection"},{"type":"text","text":" "},{"type":"text","text":"(2) or (3) in relation to the system of national significance, the Secretary must consult:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2578"},"content":[{"type":"text","text":"the entity; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2579"},"content":[{"type":"text","text":"if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator."}]}]}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2580","level":6},"content":[{"type":"text","text":"Requirement","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(5)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2581"},"content":[{"type":"text","text":"If a request under subsection"},{"type":"text","text":" "},{"type":"text","text":"(2) or (3) is given to a designated officer, the Secretary may, by written notice given to the entity, require the entity to do any or all of the following things:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2582"},"content":[{"type":"text","text":"provide the designated officer with access to premises for the purposes of undertaking the vulnerability assessment;"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2583"},"content":[{"type":"text","text":"provide the designated officer with access to computers for the purposes of undertaking the vulnerability assessment;"}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2584"},"content":[{"type":"text","text":"provide the designated officer with reasonable assistance and facilities that are reasonably necessary to allow the designated officer to undertake the vulnerability assessment."}]}]}]}]}]},{"type":"heading","attrs":{"id":"v0-p-2585","level":6},"content":[{"type":"text","text":"Notification of request","marks":[{"type":"italic"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(6)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2586"},"content":[{"type":"text","text":"If a request under subsection"},{"type":"text","text":" "},{"type":"text","text":"(2) or (3) is given to a designated officer, the Secretary must give a copy of the request to the entity."}]}]}]}]}]}