Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 10A(2): s 10A(2) Supply chain mapping: major suppliers and critical components, risks to critical components and business critical data, maximum acceptable outage, mitigation

A responsible entity for an enhanced-class asset must establish and maintain a system or process in its CIRMP to map its supply chain for major suppliers and critical components; the CIRMP must identify supply chain risks that may affect the availability, integrity, reliability or confidentiality of critical components or compromise business critical data, identify the maximum acceptable outage for the asset or any critical component arising from supply chain disruption, and as far as reasonably practicable include measures to minimise or eliminate those risks or mitigate an outage exceeding the maximum acceptable outage (supplier diversification, redundancy, recovery, resilience and restoration); for the annual report it has regard to whether the CIRMP can identify those matters.