3. To deliver this vision, ORR will focus on strengthening dutyholder’s identification and mitigation of digital safety risks across the system lifecycle, from design through to operation, change, renewal, decommissioning and disposal.

4. Our regulatory aims are to:

• Strengthen lifecycle governance of software and digital systems;
• Improve cooperation between digital safety and security disciplines;
• Enhance awareness of, and industry competence in managing, digital risk;
• Promote learning from digital safety incidents and application of health and safety by design; and,
• Improve digital resilience and recovery capability.

5. Dutyholders should be able to demonstrate they comply with the law by:

• Effective governance and accountability for digital systems and digital asset management;
• Effective management of the software lifecycle and digital change;
• Robust supply chain and procurement assurance;
• Application of digital safety and security by design;
• Threat-informed risk assessment and proportionate risk control;
• Effective management of human factors and autonomy;
• Recording and investigation of incidents, promoting continuous improvement; and,
• Sufficient management maturity, consistent with Risk Management Maturity Model (RM3) principles, to manage and continuously improve digital safety risk.