##### 30CW  Designated officers may undertake a vulnerability assessment ###### Scope - \(1\) This section applies if: - \(a\) an entity is the responsible entity for a system of national significance; and - \(b\) either: - \(i\) the Secretary has reasonable grounds to believe that if the entity were to be given a notice under subsection 30CU\(1\) or \(2\), the entity would not be capable of complying with the notice; or - \(ii\) the entity has not complied with a notice given to the entity under subsection 30CU\(1\) or \(2\)\. ###### Request - \(2\) The Secretary may give a designated officer a written request to: - \(a\) undertake a vulnerability assessment in relation to: - \(i\) the system; and - \(ii\) all types of cyber security incidents; and - \(b\) do so within the period specified in the request\. - \(3\) The Secretary may give a designated officer a written request to: - \(a\) undertake a vulnerability assessment in relation to: - \(i\) the system; and - \(ii\) one or more specified types of cyber security incidents; and - \(b\) do so within the period specified in the request\. - \(4\) Before giving a request under subsection \(2\) or \(3\) in relation to the system of national significance, the Secretary must consult: - \(a\) the entity; and - \(b\) if there is a relevant Commonwealth regulator that has functions relating to the security of that system—the relevant Commonwealth regulator\. ###### Requirement - \(5\) If a request under subsection \(2\) or \(3\) is given to a designated officer, the Secretary may, by written notice given to the entity, require the entity to do any or all of the following things: - \(a\) provide the designated officer with access to premises for the purposes of undertaking the vulnerability assessment; - \(b\) provide the designated officer with access to computers for the purposes of undertaking the vulnerability assessment; - \(c\) provide the designated officer with reasonable assistance and facilities that are reasonably necessary to allow the designated officer to undertake the vulnerability assessment\. ###### Notification of request - \(6\) If a request under subsection \(2\) or \(3\) is given to a designated officer, the Secretary must give a copy of the request to the entity\. --- ## Source and attribution Saved copy: C2018A00029 / C2026C00213 / f578e546a17068939a3a5a928474713f844dfae8 Scope: navPoint\_125 Compiled 2026\-06\-04\. This does not establish legal commencement\. Official source: https://www\.legislation\.gov\.au/C2018A00029/2026\-06\-04/2026\-06\-04/text/1/epub/OEBPS/document\_1/document\_1\.html Licence: https://creativecommons\.org/licenses/by/4\.0/ Based on content from the Federal Register of Legislation at 1 October 2026\. For the latest information on Australian Government legislation please go to https://www\.legislation\.gov\.au\. Converted XHTML into Tiptap JSON; recovered lists from paragraph classes; kept literal labels and text\. Print layout is changed\. The Commonwealth Coat of Arms is not covered by the CC BY licence\.