Security of Critical Infrastructure Act 2018 (SOCI)
Part 2C: Enhanced cyber security obligations for systems of national significance – Security of Critical Infrastructure Act 2018 (SOCI)

Security of Critical Infrastructure Act 2018 (SOCI) s30CQ-30CR: Give internal, and if required external, evaluation reports on the exercise

What does s30CQ-30CR require?

Within 30 days after completing the exercise (or a longer period allowed), the entity must prepare an evaluation report assessing its ability and preparedness to respond and to mitigate impacts and give it to the Secretary. If the Secretary reasonably believes the report was not prepared appropriately, or none was given, the Secretary may require the entity to appoint an external auditor (authorised under s 30CT, not the entity's own officer, employee or agent) to prepare a new evaluation report covering specified matters and form, and give it within the period set. Both reports are inadmissible against the entity in civil penalty proceedings other than for these duties.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Part 2C: Enhanced cyber security obligations for systems of national significance – Security of Critical Infrastructure Act 2018 (SOCI)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Security of Critical Infrastructure Act 2018 (SOCI) controls