30CS  Meaning of evaluation report

•   An evaluation report, in relation to a cyber security exercise that was undertaken in relation to a system of national significance, is a written report:

  • (a)

    if the exercise relates to all types of cyber security incidents—the purpose of which is to:

    • (i)

      evaluate the entity’s ability to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

    • (ii)

      evaluate the entity’s preparedness to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

    • (iii)

      evaluate the entity’s ability to mitigate the relevant impacts that all types of cyber security incidents could have on the system; and

  • (b)

    if the exercise relates to one or more specified types of cyber security incidents—the purpose of which is to:

    • (i)

      evaluate the entity’s ability to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

    • (ii)

      evaluate the entity’s preparedness to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

    • (iii)

      evaluate the entity’s ability to mitigate the relevant impacts that those types of cyber security incidents could have on the system; and

  • (c)

    that complies with such requirements (if any) as are specified in the rules.