Checked saved copy

Security of Critical Infrastructure Act 2018

Compilation 9 · compiled 2026-06-04

Complete saved wording and original list labels. Compilation and registration dates do not establish legal commencement.

Choose another compilation and see source history · Assent history

Sections

30CN Cyber security exercise

(1)

A cyber security exercise is an exercise:

(a)

that is undertaken by the responsible entity for a system of national significance; and

(b)

that relates to the system; and

(c)

that either:

(i)

relates to all types of cyber security incidents; or

(ii)

relates to one or more specified types of cyber security incidents; and

(d)

if the exercise relates to all types of cyber security incidents—the purpose of which is to:

(i)

test the entity’s ability to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

(ii)

test the entity’s preparedness to respond appropriately to all types of cyber security incidents that could have a relevant impact on the system; and

(iii)

test the entity’s ability to mitigate the relevant impacts that all types of cyber security incidents could have on the system; and

(e)

if the exercise relates to one or more specified types of cyber security incidents—the purpose of which is to:

(i)

test the entity’s ability to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

(ii)

test the entity’s preparedness to respond appropriately to those types of cyber security incidents that could have a relevant impact on the system; and

(iii)

test the entity’s ability to mitigate the relevant impacts that those types of cyber security incidents could have on the system; and

(f)

that complies with such requirements (if any) as are specified in the rules.

(2)

Requirements specified under paragraph (1)(f):

(a)

may be of general application; or

(b)

may relate to one or more specified systems of national significance; or

(c)

may relate to one or more specified types of cyber security incidents.

Note: For specification by class, see subsection 13(3) of the Legislation Act 2003.

(3)

Subsection (2) of this section does not, by implication, limit subsection 33(3A) of the Acts Interpretation Act 1901.