{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_115"},"content":[{"type":"heading","attrs":{"id":"v0-p-2434","level":5},"content":[{"type":"text","text":"30CM","marks":[{"type":"bold"}]},{"type":"text","text":"  ","marks":[{"type":"bold"}]},{"type":"text","text":"Requirement to undertake cyber security exercise","marks":[{"type":"bold"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(1)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2435"},"content":[{"type":"text","text":"The Secretary may, by written notice given to an entity that is the responsible entity for a system of national significance, require the entity to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2436"},"content":[{"type":"text","text":"undertake a cyber security exercise in relation to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2437"},"content":[{"type":"text","text":"the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2438"},"content":[{"type":"text","text":"all types of cyber security incidents; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2439"},"content":[{"type":"text","text":"do so within the period specified in the notice."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(2)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2440"},"content":[{"type":"text","text":"The Secretary may, by written notice given to an entity that is the responsible entity for a system of national significance, require the entity to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2441"},"content":[{"type":"text","text":"undertake a cyber security exercise in relation to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2442"},"content":[{"type":"text","text":"the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2443"},"content":[{"type":"text","text":"one or more specified types of cyber security incidents; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2444"},"content":[{"type":"text","text":"do so within the period specified in the notice."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(3)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2445"},"content":[{"type":"text","text":"The period specified in a notice under subsection"},{"type":"text","text":" "},{"type":"text","text":"(1) or (2) must not be earlier than the end of the 30"},{"type":"text","text":"‑"},{"type":"text","text":"day period that began when the notice was given."}]}]},{"type":"legalListItem","attrs":{"marker":"(4)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2446"},"content":[{"type":"text","text":"A notice under subsection"},{"type":"text","text":" "},{"type":"text","text":"(1) or (2) may also require the entity to do any or all of the following things:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2447"},"content":[{"type":"text","text":"allow one or more specified designated officers to observe the cyber security exercise;"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2448"},"content":[{"type":"text","text":"provide those designated officers with access to premises for the purposes of observing the cyber security exercise;"}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2449"},"content":[{"type":"text","text":"provide those designated officers with reasonable assistance and facilities that are reasonably necessary to allow those designated officers to observe the cyber security exercise;"}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2450"},"content":[{"type":"text","text":"allow those designated officers to make such records as are reasonably necessary for the purposes of monitoring compliance with the notice;"}]}]},{"type":"legalListItem","attrs":{"marker":"(e)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2451"},"content":[{"type":"text","text":"give those designated officers reasonable notice of the time when the cyber security exercise will begin."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(5)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2452"},"content":[{"type":"text","text":"In deciding whether to give a notice to an entity under subsection"},{"type":"text","text":" "},{"type":"text","text":"(1) or (2), the Secretary must have regard to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2453"},"content":[{"type":"text","text":"the costs that are likely to be incurred by the entity in complying with the notice; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2454"},"content":[{"type":"text","text":"the reasonableness and proportionality of the requirement in the notice; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2455"},"content":[{"type":"text","text":"such other matters (if any) as the Secretary considers relevant."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(6)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2456"},"content":[{"type":"text","text":"Before giving a notice to an entity under subsection"},{"type":"text","text":" "},{"type":"text","text":"(1) or (2) in relation to a system of national significance, the Secretary must consult:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2457"},"content":[{"type":"text","text":"the entity; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2458"},"content":[{"type":"text","text":"if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator."}]}]}]}]}]}]}]}