Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 11A(3): s 11A(3) Enhanced physical controls: access controls for workers, visitors and the public, continuous surveillance and alarms, business and out-of-hours measures, deter-detect-delay-respond-recover, mitigation and response

A responsible entity for an enhanced-class asset must, as far as reasonably practicable, consider and outline in its CIRMP the physical access controls for workers, official visitors and the public, including controls restricting critical components and critical systems to critical workers or accompanied visitors, surveillance and security alarm systems keeping critical components and critical systems under continuous monitoring, and specific protective measures for business hours and out of hours; other security measures that increase the ability to deter, detect, delay, respond to and recover from a breach for all critical components; and the mitigation and response measures to be taken where a physical security incident or consequence is detected.