Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023
8Cyber and information security hazards
Start here
Get a plain-English read of 8
Turn the raw legal text into a practical explanation grounded in Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023.
8 Cyber and information security hazards
(1) For paragraph 30AH(1)(c) of the Act, subsections (2) and (3) specify requirements for cyber and information security hazards. (2) A responsible entity must establish and maintain a process or system in the CIRMP to—as far as it is reasonably practicable to do so: (a) minimise or eliminate any material risk of a cyber and information security hazard occurring; and (b) mitigate the relevant impact of a cyber and information security hazard on the CI asset. (3) Within 12 months after the end of the applicable period mentioned in subsection 4(2), a responsible entity must comply with subsection (4) or (5). (4) A responsible entity must establish and maintain a process or system in the CIRMP to: (a) comply with a framework contained in a document mentioned in the following table as in force from time to time; and (b) meet any conditions mentioned in the table for the document.
| Item | Document | Condition |
|---|---|---|
| 1 | Australian Standard AS ISO/IEC 27001:2015 | |
| 2 | Essential Eight Maturity Model published by the Australian Signals Directorate | Meet maturity level one as indicated in the document |
| 3 | Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology of the United States of America | |
| 4 | Cybersecurity Capability Maturity Model published by the Department of Energy of the United States of America | Meet Maturity Indicator Level 1 as indicated in the document |
| 5 | The 2020‑21 AESCSF Framework Core published by Australian Energy Market Operator Limited (ACN 072 010 327) | Meet Security Profile 1 as indicated in the document |
Note Sections 30AN and 30ANA of the Act provide for the incorporation of the documents mentioned in this subsection as in force from time to time.
(5) A responsible entity must establish and maintain a process or system in the entity’s CIRMP to comply with a framework that is equivalent to a framework in a document mentioned in subsection (4), including any conditions. (6) For subsections 30AKA(1), (3) and (5) of the Act, a responsible entity must have regard to whether the entity’s CIRMP describes the cyber and information security hazards that could have a relevant impact on the asset.