Is an insurer, in Australia

Prudential Standard CPS 234 Information Security (APRA), paras 15, 18 and 21; Banking Act 1959 (Cth), ss. 11AF and 11AG · Read the law's page

• This binds an APRA-regulated entity: an authorised deposit-taking institution (including a foreign one) or authorised banking non-operating holding company, a general insurer, a life company, a private health insurer registered under the PHIPS Act, and a registrable superannuation entity licensee (reached by declaring that you provide financial services). It applies from 1 July 2019, and from the earlier of the next renewal of the third-party contract or 1 July 2020 to information assets a third party manages.
• Maintain an information security capability commensurate with the size and extent of threats to your information assets, and which enables the continued sound operation of the entity (paragraph 15).
• Maintain that capability with respect to changes in vulnerabilities and threats, including changes to information assets or your business environment (paragraph 17).
• Maintain an information security policy framework commensurate with your exposures to vulnerabilities and threats (paragraph 18).
• Classify your information assets, including those managed by related parties and third parties, by criticality and sensitivity (paragraph 20).
• Have information security controls to protect your information assets, including those managed by related parties and third parties, implemented in a timely manner and commensurate with the vulnerabilities and threats, the criticality and sensitivity of the assets, their life-cycle stage and the potential consequences of an incident (paragraph 21).
• Have robust mechanisms to detect and respond to information security incidents in a timely manner, and maintain plans to respond to the incidents you consider could plausibly occur (paragraphs 23 and 24).

Prudential Standard CPS 234 Information Security (APRA), paras 35 and 36; Banking Act 1959 (Cth), s. 11AG · Read the law's page

• This binds an APRA-regulated entity: an authorised deposit-taking institution (including a foreign one) or authorised banking non-operating holding company, a general insurer, a life company, a private health insurer registered under the PHIPS Act, and a registrable superannuation entity licensee (reached by declaring that you provide financial services). It applies from 1 July 2019.
• Notify APRA as soon as possible and, in any case, no later than 72 hours, after becoming aware of an information security incident that materially affected, or had the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers, or that has been notified to other regulators, either in Australia or other jurisdictions (paragraph 35).
• Notify APRA as soon as possible and, in any case, no later than 10 business days, after becoming aware of a material information security control weakness that you expect you will not be able to remediate in a timely manner (paragraph 36).

Security of Critical Infrastructure Act 2018 (Cth), Part 2B, ss. 30BB-30BD and 30BEA; Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022, s. 5 · Read the law's page

• This binds the responsible entity for a critical infrastructure asset to which Part 2B of the Security of Critical Infrastructure Act 2018 applies: an asset the Application Rules specify (among them a critical banking, superannuation, insurance, financial market infrastructure, hospital, electricity, gas, water, data storage or processing or telecommunications asset owned or operated by a carrier), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, provide financial services, handle health records or provide telecommunications services).
• Give the relevant Commonwealth body a report about the incident as soon as practicable, and in any event within 12 hours after you become aware that a cyber security incident has occurred or is occurring and has had, or is having, a significant impact on the availability of the asset (section 30BC(1)). The report may be given orally or in writing.
• If you give the report orally, make a written record of it in the approved form and give a copy to the relevant Commonwealth body within 84 hours after you give the report (section 30BC(3)).
• Give the relevant Commonwealth body a report as soon as practicable, and in any event within 72 hours after you become aware that a cyber security incident has occurred, is occurring or is imminent and has had, is having or is likely to have a relevant impact on the asset (section 30BD(1)).

Security of Critical Infrastructure Act 2018 (Cth), Part 2A, ss. 30AB-30AD; Security of Critical Infrastructure (Critical infrastructure risk management program) Rules (LIN 23/006) 2023, ss. 4 and 8 · Read the law's page

• This binds the responsible entity for a critical infrastructure asset to which Part 2A of the Security of Critical Infrastructure Act 2018 applies: an asset the Critical infrastructure risk management program Rules specify (a critical electricity, gas, water, liquid fuel, food and grocery, freight, broadcasting, data storage or processing or domain name system asset, a critical energy market operator asset, a designated hospital, or a critical financial market infrastructure asset used in connection with the operation of a payment system), or an asset the Minister has declared under section 51 (reached by declaring that you operate an essential service, handle health records or provide financial services).
• Adopt and maintain a written critical infrastructure risk management program that applies to you (section 30AC).
• Comply with the program you have adopted, and review it on a regular basis (sections 30AD and 30AE).
• In the program, identify each hazard with a material risk of a relevant impact on the asset and, so far as it is reasonably practicable, minimise or eliminate that risk and mitigate its impact (section 30AH(1)).
• In the program, establish and maintain a process or system to minimise or eliminate any material risk of a cyber and information security hazard occurring, and to mitigate its relevant impact on the asset, as far as it is reasonably practicable (Rules, section 8(2)).
• Within 12 months after the end of the period in section 4(2) of the Rules, comply with a framework in the Rules' table (AS ISO/IEC 27001:2015, the Essential Eight Maturity Model at maturity level one, the NIST Framework for Improving Critical Infrastructure Cybersecurity, the C2M2 at Maturity Indicator Level 1, or the AESCSF at Security Profile 1) or with an equivalent framework (Rules, section 8(3) to (5)).