9Personnel hazards

9 Personnel hazards

(1) For paragraph 30AH(1)(c) of the Act, for personnel hazards, a responsible entity must establish and maintain a process or system in the entity’s CIRMP: (a) to identify the entity’s critical workers; and (b) to permit a critical worker access to critical components of the CI asset only where the critical worker has been assessed to be suitable to have such access; and (c) as far as it is reasonably practicable to do so—to minimise or eliminate the following material risks: (i) arising from malicious or negligent employees or contractors; and (ii) arising from the off-boarding process for outgoing employees and contractors. (2) For paragraph (1)(b) and paragraph 30AH(4)(a) of the Act, the process or system for assessing the suitability of a critical worker may be a background check conducted under the AusCheck scheme.

Note Responsible entities are not required to use the AusCheck scheme to assess the suitability of critical workers. It is open for responsible entities to use other measures to assess the suitability of critical workers. That process or system must be included in the CIRMP.

(3) If a CIRMP permits a background check to be conducted under subsection (2), the background check must include assessment of information relating to the matters mentioned in paragraphs 5(a), (b), (c) and (d) of the AusCheck Act; and (a) for paragraph 30AH(4)(c) of the Act—the criteria against which the information must be assessed are the criminal history criteria; and (b) for paragraph 30AH(4)(d) of the Act—the assessment must consist of both an electronic identity verification check and an in person identity verification check. (4) A responsible entity must notify the Secretary if a background check is no longer required for a critical worker. (5) In making a suitability assessment mentioned in paragraph (1)(b), a responsible entity must consider the following: (a) any advice from the Secretary under the following provisions of the AusCheck Regulations: (i) paragraph 21DA(2)(a); (ii) paragraph 21DA(2)(b); (iii) subsection 21DA(4); (iv) subsection 21DA(5); and (b) whether permitting a critical worker to have access to critical components of the CI asset would be prejudicial to security; and (c) any other information that may affect the person’s suitability to have access to the critical components of the CI asset.

Note A responsible entity may be required to inform the Secretary of a decision to grant or revoke access to a critical infrastructure asset, in certain circumstances—see AusCheck Regulations, section 21ZA.

(6) For subsections 30AKA(1), (3) and (5) of the Act, a responsible entity must have regard: (a) to whether the CIRMP lists the entity’s critical workers; and (b) to whether the CIRMP describes the personnel risks, the occurrence of which could have a relevant impact on the asset.