Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 8(2): s 8(2) Cyber and information security hazards: minimise the material risk and mitigate the impact

A responsible entity must establish and maintain a process or system in its CIRMP, as far as reasonably practicable, to minimise or eliminate any material risk of a cyber and information security hazard occurring and to mitigate the relevant impact of such a hazard on the asset, and must have regard for the annual report to whether the CIRMP describes the cyber and information security hazards that could have a relevant impact on the asset.