35Security plans generally—additional matters and review

#### 35 Security plans generally—additional matters and review 35 Security plans generally—additional matters and review > > (1) A security plan must deal with the following matters in addition to the matters specified in the Act— > > > > > (a) a description of the security enhanced source to which the plan applies, including the following— > > > > > > > (i) the isotope, > > > > > > > (ii) the activity and the date of measurement of the activity, > > > > > > > (iii) the serial number, > > > > > > > (iv) the physical and chemical form, > > > > > (b) how the source was determined to be a category 1, 2 or 3 source, > > > > > (c) how the plan was developed, with particular regard to the findings of a risk assessment involving the following matters— > > > > > > > (i) the nature of the source, > > > > > > > (ii) the nature of dealings with the source, the environment in which the dealings occur and existing security measures, > > > > > > > (iii) identification of credible threats to the source in relation to the dealings and the likelihood and consequence of the threats eventuating, > > > > > > > (iv) an assessment of the effectiveness of existing security measures in complying with the prescribed security measures for the source, having regard to the credible threats to the source, > > > > > > > (v) identification of further action, if any, required for compliance with the prescribed security measures for the source, > > > > > (d) how compliance with the prescribed security measures for the source will be, or is being, achieved, including the security protection measures that will be used, > > > > > (e) a description of how the responsibilities for security are allocated, including how the persons to whom responsibilities are allocated are competent, qualified and authorised to carry out their responsibilities, > > > > > (f) a description of specific risks to the security of the source, for example, theft, sabotage or mechanical or electronic failure of a security protection measure, > > > > > (g) arrangements for review and revision of the plan, including the intervals at which the plan will be reviewed. > > > (2) Each person responsible for a security enhanced source must ensure the security plan is reviewed at least once every 12 months.