Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 8C: s 8C Lateral movement hazards: inventory of critical systems, recovery and continued availability, and network segregation with a three-month independence standard

A responsible entity for an enhanced-class asset must establish and maintain a process or system in its CIRMP to identify and maintain an inventory of critical systems and how they connect to other critical systems and computers, to recover and restore critical systems where an incident has a relevant impact, to ensure the asset's continued availability while critical systems are rebuilt or restored, and so far as reasonably practicable to minimise or eliminate the material risk of a lateral movement hazard and mitigate its impact; network segregation is taken to be the action that minimises or eliminates the risk where it ensures critical systems can be segregated from each other and from other computers, can be operationally independent from other internet-connected computers and critical systems, can continue operating for at least three months while other computers are being restored, has logical access controls on network traffic between critical systems and with other computers, centrally logs, monitors and routinely reviews access logs for those communication paths, and applies least privilege across computers connecting to critical systems; where the entity cannot implement it the CIRMP holds its reasonable steps.