For the purposes of security (as defined in the ASIO Act 1979) and of protecting the asset from any hazard where there is a material risk that its occurrence could have a relevant impact, the responsible entity for a prescribed critical telecommunications asset must, so far as it is reasonably practicable, protect the asset to ensure the confidentiality of communications carried on and information contained on it, and its availability and integrity. The duty includes complying with the Part 2A risk management program requirements that apply to the entity and the asset (s 30EB(3)(a)). Civil penalty 1,500 penalty units; good-faith acts in performing the duty carry no liability in damages. The Part 14 duty it replaced was a security-only duty to do the carrier's best; this one adds all hazards and the reasonably practicable standard.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.