10Supply chain hazards

10 Supply chain hazards

(1) For paragraph 30AH(1)(c) of the Act, for supply chain hazards, a responsible entity must establish and maintain in the entity’s CIRMP a process or system to: (a) as far as it is reasonably practicable to do so—minimise or eliminate the following material risks: (i) unauthorised access, interference or exploitation of the asset’s supply chain; and (ii) misuse of privileged access to the asset by any provider in the supply chain; and (iii) disruption of the asset due to an issue in the supply chain; and (iv) arising from threats to people, assets, equipment, products, services, distribution and intellectual property within supply chains; and (v) arising from major suppliers; and (vi) any failure or lowered capacity of other assets and entities in the entity’s supply chain; and (b) as far as it is reasonably practicable to do so—mitigate the relevant impact of a supply chain hazard on the asset. (2) For subsections 30AKA(1), (3) and (5) of the Act, a responsible entity must have regard: (a) to whether the CIRMP lists the entity’s major suppliers; and (b) to whether the CIRMP describes the supply chain hazards, which could have a relevant impact on the asset.