An entity carrying on a business in Australia or a responsible entity for a critical infrastructure asset under the SOCI Act that is or could be directly or indirectly impacted by a cyber security incident that has occurred, is occurring or is imminent, or another entity acting on its behalf, may provide information about the incident to the National Cyber Security Coordinator where the incident is or could reasonably be expected to be a significant cyber security incident, at any time during the response, on its own initiative or at the Coordinator's request, with no obligation to respond to a request; the provision is an authorisation to collect the information, including sensitive information, under the Privacy Act, and where it is unclear whether an incident is a cyber security incident or significant the Coordinator may collect and use the information to decide (s 36). Provision under Part 4 does not affect any obligation to provide the same information under Part 3, SOCI Part 2B or the Telecommunications Act (s 44).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.