30CN  Cyber security exercise

• (1)

  A cyber security exercise is an exercise:

  • (a)

    that is undertaken by the responsible entity for a system of national significance; and

  • (b)

    that relates to the system; and

  • (c)

    that either:

    • (i)

      relates to all types of cyber security incidents; or

    • (ii)

      relates to one or more specified types of cyber security incidents; and

  • (d)

    if the exercise relates to all types of cyber security incidents—the purpose of which is to:

    • (i)

      test the entity’s ability to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

    • (ii)

      test the entity’s preparedness to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

    • (iii)

      test the entity’s ability to mitigate the relevant impacts that all types of cyber security incidents could have on the system; and

  • (e)

    if the exercise relates to one or more specified types of cyber security incidents—the purpose of which is to:

    • (i)

      test the entity’s ability to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

    • (ii)

      test the entity’s preparedness to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

    • (iii)

      test the entity’s ability to mitigate the relevant impacts that those types of cyber security incidents could have on the system; and

  • (f)

    that complies with such requirements (if any) as are specified in the rules.

• (2)

  Requirements specified under paragraph (1)(f):

  • (a)

    may be of general application; or

  • (b)

    may relate to one or more specified systems of national significance; or

  • (c)

    may relate to one or more specified types of cyber security incidents.

  Note: For specification by class, see subsection 13(3) of the Legislation Act 2003.

• (3)

  Subsection (2) of this section does not, by implication, limit subsection 33(3A) of the Acts Interpretation Act 1901.