If:
(a) an entity is the responsible entity for a system of national significance; and
(b) the entity has adopted an incident response plan that applies to the entity;
the entity must comply with:
(c) the incident response plan; or
(d) if the plan has been varied on one or more occasions--the plan as varied.
Civil penalty: 200 penalty units.