{"type":"doc","content":[{"type":"section","attrs":{"id":"navPoint_116"},"content":[{"type":"heading","attrs":{"id":"v0-p-2459","level":5},"content":[{"type":"text","text":"30CN  Cyber security exercise","marks":[{"type":"bold"}]}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(1)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2460"},"content":[{"type":"text","text":"A "},{"type":"text","text":"cyber security exercise","marks":[{"type":"bold"},{"type":"italic"}]},{"type":"text","text":" is an exercise:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2461"},"content":[{"type":"text","text":"that is undertaken by the responsible entity for a system of national significance; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2462"},"content":[{"type":"text","text":"that relates to the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2463"},"content":[{"type":"text","text":"that either:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2464"},"content":[{"type":"text","text":"relates to all types of cyber security incidents; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2465"},"content":[{"type":"text","text":"relates to one or more specified types of cyber security incidents; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(d)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2466"},"content":[{"type":"text","text":"if the exercise relates to all types of cyber security incidents—the purpose of which is to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2467"},"content":[{"type":"text","text":"test the entity’s ability to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2468"},"content":[{"type":"text","text":"test the entity’s preparedness to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(iii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2469"},"content":[{"type":"text","text":"test the entity’s ability to mitigate the relevant impacts that all types of cyber security incidents could have on the system; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(e)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2470"},"content":[{"type":"text","text":"if the exercise relates to one or more specified types of cyber security incidents—the purpose of which is to:"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(i)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2471"},"content":[{"type":"text","text":"test the entity’s ability to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(ii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2472"},"content":[{"type":"text","text":"test the entity’s preparedness to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and"}]}]},{"type":"legalListItem","attrs":{"marker":"(iii)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2473"},"content":[{"type":"text","text":"test the entity’s ability to mitigate the relevant impacts that those types of cyber security incidents could have on the system; and"}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(f)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2474"},"content":[{"type":"text","text":"that complies with such requirements (if any) as are specified in the rules."}]}]}]}]},{"type":"legalListItem","attrs":{"marker":"(2)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2475"},"content":[{"type":"text","text":"Requirements specified under paragraph (1)(f):"}]},{"type":"legalList","attrs":{},"content":[{"type":"legalListItem","attrs":{"marker":"(a)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2476"},"content":[{"type":"text","text":"may be of general application; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(b)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2477"},"content":[{"type":"text","text":"may relate to one or more specified systems of national significance; or"}]}]},{"type":"legalListItem","attrs":{"marker":"(c)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2478"},"content":[{"type":"text","text":"may relate to one or more specified types of cyber security incidents."}]}]}]},{"type":"paragraph","attrs":{"id":"v0-p-2479"},"content":[{"type":"text","text":"Note: For specification by class, see subsection 13(3) of the "},{"type":"text","text":"Legislation Act 2003","marks":[{"type":"italic"}]},{"type":"text","text":"."}]}]},{"type":"legalListItem","attrs":{"marker":"(3)"},"content":[{"type":"paragraph","attrs":{"id":"v0-p-2480"},"content":[{"type":"text","text":"Subsection (2) of this section does not, by implication, limit subsection 33(3A) of the "},{"type":"text","text":"Acts Interpretation Act 1901","marks":[{"type":"italic"}]},{"type":"text","text":"."}]}]}]}]}]}