AustraliaPrudential Standard CPS 234 Information Security, Notification to APRA
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an APRA-regulated entity: an authorised deposit-taking institution (including a foreign one) or authorised banking non-operating holding company, a general insurer, a life company, a private health insurer registered under the PHIPS Act, and a registrable superannuation entity licensee (reached by declaring that you provide financial services). It applies from .
- Notify APRA as soon as possible and, in any case, no later than 72 hours, after becoming aware of an information security incident that materially affected, or had the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers, or that has been notified to other regulators, either in Australia or other jurisdictions (paragraph 35).
- Notify APRA as soon as possible and, in any case, no later than 10 business days, after becoming aware of a material information security control weakness that you expect you will not be able to remediate in a timely manner (paragraph 36).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Australian Prudential Regulation Authority, which determines prudential standards for authorised deposit-taking institutions under section 11AF of the Banking Act 1959.
Settledness
- As of
- Open questions
- Does section 11AG of the Banking Act 1959, which is stated for authorised deposit-taking institutions, have an equivalent in the Insurance Act 1973, the Life Insurance Act 1995, the Private Health Insurance (Prudential Supervision) Act 2015 and the Superannuation Industry (Supervision) Act 1993 for the other entities the Prudential Standard reaches?
What this law does
Paragraph 35 of Prudential Standard CPS 234 requires an APRA-regulated entity to notify APRA as soon as possible and, in any case, no later than 72 hours, after becoming aware of an information security incident that materially affected, or had the potential to materially affect, the entity or the interests of depositors, policyholders, beneficiaries or other customers.
Paragraph 35 also reaches an information security incident that has been notified to other regulators, either in Australia or other jurisdictions. Paragraph 36 of the Prudential Standard requires an APRA-regulated entity to notify APRA no later than 10 business days after it becomes aware of a material information security control weakness that it expects it will not be able to remediate in a timely manner.
The Prudential Standard applies to all APRA-regulated entities, among them authorised deposit-taking institutions, general insurers, life companies, private health insurers and RSE licensees. The Prudential Standard commences on . Section 11AG of the Banking Act 1959 requires an authorised deposit-taking institution to which a prudential standard applies to comply with the standard.
When LexLint raises it
When your app profile says your app provides financial services.