If:
(a) an entity is the responsible entity for a system of national significance; and
(b) the entity has adopted an incident response plan that applies to the entity;
the entity must take all reasonable steps to ensure that the plan is up to date.
Civil penalty: 200 penalty units.