Home / Rules
The rules behind every step
Every step in every scenario rests on a clause: a section of an Act, a paragraph of an APRA standard, an NDIS rule, an ISO/IEC clause, a SOC 2 criterion, or the SPECIMEN organisation's own procedure. Each is shown with the edition it was written against and the date it was checked current.
| Instrument | Edition | Checked | Rules | Scenarios |
|---|---|---|---|---|
| Privacy Act 1988 (Cth) | Privacy Act 1988 (Cth), Compilation No. 104 (C2026C00227), in force 4 June 2026, registered 17 June 2026 | 2026-10-06 | 6 | KC-02, KC-05 |
| APRA CPS 234 Information Security | CPS 234, July 2019 (in force 1 July 2019); no later issue | 2026-10-07 | 3 | KC-05, KC-07 |
| APRA CPS 230 Operational Risk Management | CPS 230, July 2026 issue (commenced 1 July 2026; supersedes the July 2023 issue) | 2026-10-07 | 11 | KC-05, KC-07 |
| Cyber Security Act 2024 (Cth) | Cyber Security Act 2024 (Cth), No. 98 of 2024 (C2024A00098), with the Cyber Security (Ransomware Payment Reporting) Rules 2025 (F2025L00278) | 2026-09-25 | 3 | KC-04 |
| NDIS (Practice Standards: Worker Screening) Rules 2018 | F2018L00887, Compilation No. 4 (F2021C00788), in force from 31 July 2021 | 2026-09-30 | 9 | KC-03 |
| NDIS (Incident Management and Reportable Incidents) Rules 2018 | F2018L00633 as made (unamended), in force 1 July 2018 | 2026-10-01 | 2 | KC-03 |
| NDIS Practice Standards and Quality Indicators | NDIS (Provider Registration and Practice Standards) Rules 2018 Schedules 1 to 8, Compilation No. 6 (F2026C00527), in force 1 July 2026 | 2026-10-01 | 1 | KC-03 |
| ISO/IEC 27001:2022 | ISO/IEC 27001:2022 (third edition, October 2022) with Amendment 1:2024 | 2026-10-07 | 11 | KC-01, KC-08 |
| SOC 2 (Trust Services Criteria) | 2017 Trust Services Criteria with revised points of focus (2022) | 2026-10-07 | 5 | KC-01, KC-08 |
| ISO/IEC 42001:2023 | ISO/IEC 42001:2023 (first edition, December 2023) | 2026-10-07 | 7 | KC-06 |
| ISO/IEC 42005:2025 | ISO/IEC 42005:2025 (first edition, May 2025) | 2026-10-07 | 5 | KC-06 |
| Essential Eight Maturity Model | Essential Eight Maturity Model, November 2023, with the Essential Eight to ISM mapping (December 2023) | 2026-09-30 | 2 | KC-02, KC-04 |
| The SPECIMEN organisation's own procedure | SPECIMEN procedure shipped with the scenario inputs | 2026-10-07 | 15 | KC-01, KC-02, KC-03, KC-04, KC-05, KC-06, KC-07, KC-08 |
Not cited in this version: the EU AI Act (see the AI system approval scenario for why), ISO/IEC 42006 and ISO/IEC 23894. No superseded instrument is cited anywhere.