30CW  Designated officers may undertake a vulnerability assessment
Scope
(1)

This section applies if:

(a)

an entity is the responsible entity for a system of national significance; and

(b)

either:

(i)

the Secretary has reasonable grounds to believe that if the entity were to be given a notice under subsection 30CU(1) or (2), the entity would not be capable of complying with the notice; or

(ii)

the entity has not complied with a notice given to the entity under subsection 30CU(1) or (2).

Request
(2)

The Secretary may give a designated officer a written request to:

(a)

undertake a vulnerability assessment in relation to:

(i)

the system; and

(ii)

all types of cyber security incidents; and

(b)

do so within the period specified in the request.

(3)

The Secretary may give a designated officer a written request to:

(a)

undertake a vulnerability assessment in relation to:

(i)

the system; and

(ii)

one or more specified types of cyber security incidents; and

(b)

do so within the period specified in the request.

(4)

Before giving a request under subsection (2) or (3) in relation to the system of national significance, the Secretary must consult:

(a)

the entity; and

(b)

if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator.

Requirement
(5)

If a request under subsection (2) or (3) is given to a designated officer, the Secretary may, by written notice given to the entity, require the entity to do any or all of the following things:

(a)

provide the designated officer with access to premises for the purposes of undertaking the vulnerability assessment;

(b)

provide the designated officer with access to computers for the purposes of undertaking the vulnerability assessment;

(c)

provide the designated officer with reasonable assistance and facilities that are reasonably necessary to allow the designated officer to undertake the vulnerability assessment.

Notification of request
(6)

If a request under subsection (2) or (3) is given to a designated officer, the Secretary must give a copy of the request to the entity.