{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_123"},"content":[{"type":"heading","attrs":{"id":"v0-p-2540","level":5},"content":[{"type":"text","text":"30CU","marks":[{"type":"bold"}]},{"type":"text","text":"  ","marks":[{"type":"bold"}]},{"type":"text","text":"Requirement to undertake vulnerability assessment","marks":[{"type":"bold"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(1)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2541"},"content":[{"type":"text","text":"The Secretary may, by written notice given to an entity that is the responsible entity for a system of national significance, require the entity to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2542"},"content":[{"type":"text","text":"undertake, or cause to be undertaken, a vulnerability assessment in relation to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2543"},"content":[{"type":"text","text":"the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2544"},"content":[{"type":"text","text":"all types of cyber security incidents; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2545"},"content":[{"type":"text","text":"do so within the period specified in the notice."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(2)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2546"},"content":[{"type":"text","text":"The Secretary may, by written notice given to an entity that is the responsible entity for a system of national significance, require the entity to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2547"},"content":[{"type":"text","text":"undertake, or cause to be undertaken, a vulnerability assessment in relation to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2548"},"content":[{"type":"text","text":"the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2549"},"content":[{"type":"text","text":"one or more specified types of cyber security incidents; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2550"},"content":[{"type":"text","text":"do so within the period specified in the notice."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(3)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2551"},"content":[{"type":"text","text":"In deciding whether to give a notice to an entity under subsection"},{"type":"text","text":" "},{"type":"text","text":"(1) or (2), the Secretary must have regard to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2552"},"content":[{"type":"text","text":"the costs that are likely to be incurred by the entity in complying with the notice; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2553"},"content":[{"type":"text","text":"the reasonableness and proportionality of the requirement in the notice; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2554"},"content":[{"type":"text","text":"such other matters (if any) as the Secretary considers relevant."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(4)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2555"},"content":[{"type":"text","text":"Before giving a notice to an entity under subsection"},{"type":"text","text":" "},{"type":"text","text":"(1) or (2) in relation to the system of national significance, the Secretary must consult:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2556"},"content":[{"type":"text","text":"the entity; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2557"},"content":[{"type":"text","text":"if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator."}]}]}]}]}]}]}]}