Chapter 8B: Market Participants—Critical Business Services, Information Security and Business Continuity Plans
Part 8B.1 Application and Definitions
8B.1.1 Application of Chapter
This Chapter applies to:
(a) Participants of a Market on or through which offers to acquire or dispose of Equity Market Products are made or accepted;
(b) CGS Market Participants.
8B.1.2 Definitions
In this Chapter:
Business Continuity Plans has the meaning given by Rule 8B.4.1.
Critical Business Services, in relation to a Participant, means functions, infrastructure, processes or systems which in the event of failure to operate effectively, would or would be likely to cause significant disruption to the Participant’s Participant Operations or materially impact the Participant’s Participant Services.
Note: Critical Business Services referred to in this definition would generally include but are not limited to, functions, infrastructure, processes and systems that deliver or support order acceptance, routing and entry, clearing and settlement of transactions, payments and deliveries of financial products and funds, accounting for or reconciling client money, trust accounts, securities and funds, confirmations and regulatory data reporting.
Critical Business Services Arrangements has the meaning given by Rule 8B.2.1.
Information Asset means information and information technology, including software, hardware and data (both soft and hard copy).
Major Event has the meaning given by Rule 8B.4.1.
Operator means an operator of a Market referred to in paragraph 8B.1.1(a) or of a CGS Market.
Outsourcing Arrangement means an arrangement between a Participant and another person (Service Provider) under which the Service Provider will provide, operate or support one or more of the Participant’s Critical Business Services.
Participant means a participant referred to in paragraph 8B.1.1(a) or (b).
Participant Operations, in relation to a Participant, means the operations, activities or conduct of the Participant in connection with the Markets and CGS Markets of which it is a Participant.
Participant Services, in relation to a Participant, means the services provided by the Participant in connection with the Markets and CGS Markets of which it is a Participant.
Service Provider: has the meaning given in the definition of Outsourcing Arrangement.
Part 8B.2 Critical Business Services
8B.2.1 Resilience, reliability, integrity and security
Adequate arrangements
Part Part 8B - ASIC Market Integrity Rules (Securities Markets) 2017 - Market Participants—Critical Business Services, Information Security and Business Continuity Plans | Zoe
(1) A Participant must have adequate arrangements (Critical Business Services Arrangements) to ensure the resilience, reliability, integrity and security of its Critical Business Services.
Note: Arrangements referred to in subrule (1) would generally include, but are not limited to, policies, procedures and organisational resources including financial, human and technological resources.
(2) Without limiting subrule (1), a Participant’s Critical Business Services Arrangements must include arrangements for:
(a) identifying Critical Business Services; and
(b) identifying, assessing, managing and monitoring for any risks to the resilience, reliability, integrity and security of Critical Business Services; and
(c) ensuring Critical Business Services have sufficient and scalable capacity for the Participant’s ongoing and planned Participant Operations and Participant Services; and
(d) preventing unauthorised access to or use of Critical Business Services; and
(e) managing the implementation of new Critical Business Services and of changes to existing Critical Business Services in accordance with Rule 8B.2.2; and
(f) dealing with a Major Event in accordance with Part 8B.4 of these Rules; and
(g) managing Outsourcing Arrangements in relation to Critical Business Services in accordance with Rule 8B.2.3.
Review and change of arrangements
(3) A Participant must undertake a review of its Critical Business Services Arrangements:
(a) following each material change to its Critical Business Services; and
(b) at least once every 12 months,
and apply recommended changes to the Critical Business Services Arrangements arising from the review to ensure they comply with subrules (1) and (2).
Documentation of arrangements
(4) A Participant must document:
its Critical Business Services Arrangements; and
the scope and results of each review performed in accordance with subrule (3); and
any changes applied to the Critical Business Services Arrangements as result of a review or otherwise,
and must maintain that documentation for a period of at least seven years from the later of the date it is created or the date it is last amended.
8B.2.2 Change management for Critical Business Services
(1) A Participant must have adequate arrangements to ensure that its Critical Business Services Arrangements continue to comply with subrule 8B.2.1(1) following the implementation of a new Critical Business Service or of a change to an existing Critical Business Service.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include arrangements for:
testing new Critical Business Services or material changes to existing Critical Business Services before implementation; and
communicating with persons that may be materially impacted by the implementation for the purposes of ensuring those persons are adequately informed about the nature, timing and impact of the implementation a reasonable time before it occurs; and
ensuring, to the extent reasonably practicable, that persons that may be materially impacted by the implementation are adequately prepared for the implementation before it occurs.
Note: Persons that may be materially impacted by the implementation may include ASIC, other Participants, Operators and the operators of licensed clearing and settlement facilities.
8B.2.3 Outsourcing of Critical Business Services
(1) A Participant that enters into an Outsourcing Arrangement must:
before entering into the Outsourcing Arrangement, conduct due diligence enquiries for the purposes of ensuring the Service Provider has the ability and capacity to provide the services covered by the Outsourcing Arrangement effectively; and
ensure that the Outsourcing Arrangement is contained in a documented legally binding agreement between the Participant and the Service Provider, that:
sets out the nature, scope and quality of the services to be provided under the Outsourcing Arrangement; and
requires the Service Provider to give written notice to the Participant before the Service Provider:
enters into any arrangement with another person (Sub-Contractor) under which the Sub-Contractor will provide services material to the provision by the Service Provider of the services covered by the Outsourcing Arrangement; or
makes any other material change to the manner in which the services covered by the Outsourcing Arrangements are provided; and
deals with the circumstances and manner in which the Outsourcing Arrangement may be terminated; and
provides for the orderly transfer of services provided under the Outsourcing Arrangement to the Participant or another Service Provider in the event of termination of the Outsourcing Arrangement; and
while the Outsourcing Arrangement is in place, monitor the performance of the Service Provider for the purposes of ensuring the Service Provider is providing the services covered by the Outsourcing Arrangement effectively and has the ability and capacity to continue to provide those services effectively; and
have in place adequate arrangements to:
identify any conflicts of interest between the Participant and the Service Provider, including conflicts involving Sub-Contractors and related entities of the Participant, Service Provider and any Sub-Contractor; and
manage any conflicts of interest which have been identified or could arise; and
have in place adequate arrangements to ensure the Participant is able to comply with its obligations under the Act and these Rules in relation to the Critical Business Services the subject of an Outsourcing Arrangement including, without limitation, arrangements with the Service Provider to:
(i) ensure the resilience, reliability, integrity and security of those Critical Business Services in accordance with Rule 8B.2.1; and
(ii) ensure the confidentiality, integrity and availability of information obtained, held or used by the Participant in relation to those Critical Business Services in accordance with Part 8B.3 of these Rules; and
(iii) deal with a Major Event in accordance with Part 8B.4 of these Rules; and
Note: Such arrangements may include, without limitation, requirements on the Service Provider to:
Note: (a) protect technology from security breaches and cyber-incidents; and
Note: (b) protect proprietary and client-related information and software; and
Note: (c) protect confidential, market-sensitive and personal information from intentional or inadvertent disclosure to unauthorised individuals; and
Note: (d) establish, implement and maintain emergency procedures and a plan for disaster recovery with periodic testing of backup facilities.
ensure that the Participant and its auditors are able to promptly, upon request, access books, records and other information of the Service Provider relating to the Critical Business Services; and
ensure that ASIC has the same access to all books, records and other information relating to the Critical Business Services and maintained by the Service Provider, that ASIC would have if not for the Outsourcing Arrangement; and
ensure that for each Outsourcing Arrangement, the Participant’s Board or a director or senior manager have confirmed that they have complied with the Participant’s obligations in this subrule and made a written attestation to that effect.
(2) The Participant must comply with subrule (1) in a manner that is appropriate to:
(a) the nature, complexity and risks of the Outsourcing Arrangement; and
(b) the materiality of the Outsourcing Arrangement to the Participant’s Participant Operations and Participant Services.
(3) In determining for the purposes of subrule (1) whether the Service Provider has the ability and capacity to provide the services covered by the Outsourcing Arrangement effectively, the Participant must take into account the extent to which the Service Provider is providing the same or similar services to other Participants.
Part 8B.3 Information security
8B.3.1 Information security
(1) A Participant must have adequate arrangements to ensure the confidentiality, integrity and availability of information obtained, held or used by the Participant in relation to its Participant Operations and Participant Services.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include:
arrangements to identify and document Information Assets that are integral to the provision of the Participant’s Participant Operations and Participant Services; and
controls, including automated controls, designed to prevent unauthorised access to Information Assets; and
controls for identifying, assessing, managing and monitoring for unauthorised access to Information Assets; and
arrangements designed to protect Information Assets from theft, loss or corruption.
(3) A Participant must have adequate arrangements to ensure the availability of access to data obtained, held or used by the Participant in its Participant Operations and Participant Services.
(4) Without limiting subrule (3), the arrangements referred to in that subrule must include arrangements designed to provide for the backup of the data and the timely recovery of the data in the event of any theft, corruption or loss of the data.
(5) A Participant must maintain, for a period of at least seven years after the relevant event, records of any:
unauthorised access to or use of its Critical Business Services that impacts the effective operation or delivery of those services; or
unauthorised access to or use of market-sensitive, confidential or personal information.
Part 8B.4 Business Continuity Plans
8B.4.1 Business continuity
Business Continuity Plans
(1) A Participant must establish, implement and maintain plans (Business Continuity Plans) for effectively responding to an event (Major Event) that would or would be likely to cause significant disruption to the Participant’s Participant Operations or materially impact the Participant’s Participant Services.
Note: A Major Event may include the failure of a Critical Business Service, including one operated by a Service Provider, or an event such as a pandemic or influenza event, natural disaster, cyber-attack or power failure.
(2) A Participant’s Business Continuity Plans must be designed to enable:
continuity of the usual operation of the Participant’s Critical Business Services, Participant Operations and Participant Services during a Major Event; and
to the extent continuation of the usual operation of the Participant’s Critical Business Services, Participant Operations and Participant Services during a Major Event is not possible, timely and orderly restoration of those usual operations following the Major Event.
(3) A Participant’s Business Continuity Plans must be appropriate to the nature, scale and complexity of the Participant’s Critical Business Services, Participant Operations and Participant Services and to the Participant’s structure and location.
(4) Without limiting subrules (1) to (3), the Participant’s Business Continuity Plans must identify and address:
the type of Major Events that may impact the Participant’s Critical Business Services, Participant Operations and Participant Services; and
activation procedures including trigger conditions for enacting the Participant’s Business Continuity Plans; and
the potential impact Major Events may have on the Participant’s Critical Business Services, Participant Operations and Participant Services; and
the classification of types of Major Events according to the potential severity of the impacts referred to in paragraph (c); and
escalation procedures that are appropriate to the classification referred to in paragraph (d); and
the actions, arrangements and resources required to achieve the outcomes referred to in subrule (2); and
Note: The actions, arrangements and resources covered by this paragraph would include key operational functions and processes, staff, alternate suppliers/service providers, technology, alternative premises and other physical infrastructure.
specific objectives for the time taken to achieve the outcomes referred to in paragraph (2)(b); and
procedures for communicating during a Major Event with persons that may be impacted by the Major Event, for the purposes of ensuring those persons are adequately informed about:
(i) the nature and impact of the Major Event; and
(ii) the steps that are being taken or will be taken to manage the Major Event; and
(iii) the likely timing of the steps referred to in subparagraph (ii); and
(iv) the likely timing of the resumption of the usual operation of the Participant’s Critical Business Services, Participant Operations and Participant Services; and
any operational dependencies between the Participant and any other person that may affect the matters referred to in paragraphs (a) to (h).
(5) Without limiting paragraph (4)(i), a Participant must have in place adequate arrangements to ensure that the Participant is able to carry out its Business Continuity Plans with respect to any Critical Business Services the subject of an Outsourcing Arrangement.
Notification of a Major Event
(6) Without limiting paragraph (4)(h), a Participant must notify ASIC immediately upon becoming aware of a Major Event.
(7) If a notification is made under subrule (6), the Participant must within seven days of the notification provide ASIC with a written report detailing:
the circumstances of the Major Event; and
the steps taken to manage the Major Event.
Review, update and testing of plans
(8) A Participant must:
review and test its Business Continuity Plans and the arrangements referred to in subrule (5):
at a frequency and in a manner appropriate to the nature, scale and complexity of the Participant’s Critical Business Services, Participant Operations and Participant Services and to the Participant’s structure and location; and
at a minimum:
each time there is a material change to the Participant’s Critical Business Services, Participant Operations and Participant Services or to the Participant’s structure and location; and
as soon as practicable after the occurrence of a Major Event; and
once every 12 months; and
update the Business Continuity Plans as required to ensure they comply with subrules (1) to (4).
Documentation of plans and testing
(9) A Participant must document:
its Business Continuity Plans; and
the scope and results of all reviews and testing performed in accordance with subrule (8),
and must maintain that documentation for a period of at least seven years from the later of the date it is created or the date it is last amended.
Part 8B.5 Governance
8B.5.1 Responsibility for compliance
(1) A Participant must have appropriate governance arrangements and adequate financial, technological and human resources to comply with its obligation under this Chapter 8B.
(2) Without limiting subrule (1), the arrangements referred to in that subrule must include arrangements for the Participant’s Board or senior management to have oversight of the establishment, implementation, maintenance, review, testing and documentation of the Participant’s Business Continuity Plans.