4.1Protective security capability

4.1 Protective security capability

(1) Protective security capability of an accredited entity means the accredited entity’s ability to manage the protective security of its DI data environment through the implementation and operation of processes and controls, including by: (a) allocating adequate budget and resources; and (b) providing for management oversight. (2) An accredited entity’s protective security capability must be appropriate and adapted to respond to cyber security risks, including emerging risks, having regard to: (a) the extent and nature of the personal information the entity holds; (b) the extent and nature of cyber security risks, threats and vulnerabilities; (c) the potential loss or damage to one or more individuals if a cyber security incident were to occur; (d) the potential loss or damage to relying parties if a cyber security incident were to occur; and (e) the potential loss or damage to entities and individuals if a cyber security incident were to occur and result in a digital ID being compromised or otherwise rendered unreliable. (3) An accredited entity must take reasonable steps to prevent, detect and deal with cyber security incidents, including by: (a) having and maintaining protective security capability; (b) continuously improving its protective security capability; and (c) identifying, treating and managing cyber security risks.