Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 10A(4): s 10A(4) Vendor assessment of each existing or proposed major supplier: FOCI legal exposure, sanctions, access and control, combined risk against the MAO, steps

A responsible entity for an enhanced-class asset must establish and maintain a system or process in its CIRMP to assess the risks of each existing or proposed major supplier, identifying for each the legislative or other legal requirements the supplier is subject to in relation to FOCI risks, restrictions, sanctions or other impediments affecting the jurisdiction the entity may be subject to, the access, influence and control the supplier has over the asset through its product or service, the extent to which those matters together may present a material risk or exceed the maximum acceptable outage of the supplier's product or service, and as far as reasonably practicable the steps to minimise or eliminate the material risks and mitigate the hazard's impact; for the annual report it has regard to whether the CIRMP can identify those five matters.