30CD  Responsible entity must have an incident response plan

•   If:

  • (a)

    an entity is the responsible entity for a system of national significance; and

  • (b)

    the statutory incident response planning obligations apply to the entity in relation to:

    • (i)

      the system; and

    • (ii)

      cyber security incidents;

  the entity must:

  • (c)

    adopt; and

  • (d)

    maintain;

  an incident response plan that applies to the entity in relation to:

  • (e)

    the system; and

  • (f)

    cyber security incidents.

  Civil penalty: 200 penalty units.