67. Agency’s powers

Subject to the arrangements established and approved under section 66, the Agency may do any or all of the following in relation to the designated public entity:

develop, and recommend to the designated public entity, directives, codes, standards or guidelines in relation to the architecture or use of the relevant system or service of the designated public entity;

carry out an audit, or require an audit to be carried out, of the architecture or use of the relevant system or service;

advise the designated public entity to implement any security, mitigation or recovery measures that the Agency considers necessary;

advise the designated public entity on the deployment of any resources (including personnel) of the designated public entity, that the Agency considers necessary, for the purpose of implementing the measures;

report to the designated public entity and the responsible Minister on the matter, including on the outcome of the investigations undertaken by, and the status of the designated public entity’s adoption and implementation of any advice or recommendation of, the Agency.