This section applies if an entity has undertaken a cyber security exercise under section 30CM, and:
all of the following conditions are satisfied:
the entity has prepared, or purported to prepare, an evaluation report under section 30CQ relating to the exercise;
the entity has given a copy of the report to the Secretary;
the Secretary has reasonable grounds to believe that the report was not prepared appropriately; or
the entity has contravened section 30CQ.
The Secretary may, by written notice given to the entity, require the entity to:
appoint an external auditor; and
arrange for the external auditor to prepare an evaluation report (the new evaluation report) relating to the exercise; and
arrange for the external auditor to give the new evaluation report to the entity; and
give the Secretary a copy of the new evaluation report within:
the period specified in the notice; or
if the Secretary allows a longer period—that longer period.
The notice must specify:
the matters to be covered by the new evaluation report; and
the form of the new evaluation report and the kinds of details it is to contain.
Before giving a notice to an entity under this section in connection with a cyber security exercise that relates to a system of national significance, the Secretary must consult:
the entity; and
if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.
An individual is not eligible to be appointed as an external auditor by the entity if the individual is an officer, employee or agent of the entity.
An entity must comply with a requirement under subsection (2).
Civil penalty: 200 penalty units.
The new evaluation report is not admissible in evidence against the entity in civil proceedings relating to a contravention of a civil penalty provision of this Act (other than subsection (6)).