When the responsible entity for an asset to which Part 2B applies becomes aware that a cyber security incident (unauthorised access to or modification of data or programs, or unauthorised impairment of communications or of a computer's availability, reliability, security or operation) has occurred or is occurring and has had or is having a significant impact on the asset's availability (it supports essential goods or services and has materially disrupted them, or a circumstance in the rules), it must report to the relevant Commonwealth body (ASD) as soon as practicable and within 12 hours, including any prescribed information. An oral report must be followed by a written record in the approved form within 84 hours unless exempted. Good-faith compliance is protected from damages claims, including for group members and contracted service providers (s 30BE). Part 2B applies to the assets in the Application Rules (after a 3-month grace period).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.