30CQ  Internal evaluation report

• (1)

  If an entity undertakes a cyber security exercise under section 30CM, the entity must:

  • (a)

    do both of the following:

    • (i)

      prepare an evaluation report relating to the cyber security exercise;

    • (ii)

      give a copy of the report to the Secretary; and

  • (b)

    do so:

    • (i)

      within 30 days after the completion of the exercise; or

    • (ii)

      if the Secretary allows a longer period—within that longer period.

  Civil penalty: 200 penalty units.

• (2)

  An evaluation report prepared by an entity under subsection (1) is not admissible in evidence against the entity in civil proceedings relating to a contravention of a civil penalty provision of this Act (other than subsection (1) of this section or subsection 30CR(6)).