The Board may cause a review of a cyber security incident or series of related incidents on written referral by the Minister, the Coordinator, an entity impacted by the incident or a Board member, but only where it is satisfied the incident seriously prejudiced or could reasonably be expected to seriously prejudice Australia's social or economic stability, defence or national security, involved novel or complex methods or technologies whose understanding will significantly improve preparedness, resilience or response, or is or could be of serious concern to the Australian people; after the incident and the immediate response have ended; and once the Minister has approved the terms of reference, which must name one or more standing members for the review panel of the Chair, those members and any Expert Panel members appointed. The Board may discontinue a review at any time and must publish notice within 28 days (s 47); the rules may govern referrals, prioritisation, terms of reference, notification, timing, discontinuance and submissions. Under the Cyber Incident Review Board Rules 2025, the Board must consider every written referral and decide whether to review any matter it raises (s 7); prioritise referrals and reviews by the severity and scale of the incidents' impact and the availability, capacity and relevant skills of standing members and Expert Panel members (s 8); make each review's terms of reference specify the number of standing members and Expert Panel members, the minimum security clearance a standing member needs to take part, and any additional eligibility requirements for Expert Panel members, varying them only with the Minister's approval (s 9); not conduct a review at a time the Chair considers would interfere with or prejudice an investigation or proceedings for an offence or civil penalty contravention (s 10); and, as soon as practicable after deciding to review, publish a notification on the Department's website or otherwise giving the numbers of standing and Expert Panel members, the incident, a brief account of how it meets the s 46(2) criteria and the proposed timeframes (s 11).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.