The responsible entity for a relevant critical infrastructure asset must adopt and maintain a written critical infrastructure risk management program that applies to it, and must comply with the program as varied. Part 2A applies to the telecommunications classes by TSRMP Rules s 7, after a grace period ending on the later of six months after the Rules commenced (commencement with Schedule 5 on 4 April 2025) and six months after the asset became a relevant asset. The program's purpose is, for each asset, to identify each hazard with a material risk of a relevant impact, minimise or eliminate that risk and mitigate the impact so far as reasonably practicable (s 30AH(1)). Home Affairs says a single program may cover assets in several classes only if it meets the TSRMP standard. Civil penalty 200 penalty units for each of s 30AC and s 30AD.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.