Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 8(3): s 8(3) Adopt one of five cyber frameworks, or an equivalent, within 12 months of the grace period

Within 12 months after the end of the s 4(2) grace period a responsible entity must establish and maintain a process or system in its CIRMP to comply with a framework in one of the listed documents as in force from time to time and meet its condition: AS ISO/IEC 27001:2015; the ASD Essential Eight Maturity Model at maturity level one; the NIST Framework for Improving Critical Infrastructure Cybersecurity; the US Department of Energy Cybersecurity Capability Maturity Model at maturity indicator level 1; or the 2020-21 AESCSF Framework Core at security profile 1; or a framework equivalent to one of them including its conditions.