AustraliaPrudential Standard CPS 234 Information Security, Security Capability and Controls
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an APRA-regulated entity: an authorised deposit-taking institution (including a foreign one) or authorised banking non-operating holding company, a general insurer, a life company, a private health insurer registered under the PHIPS Act, and a registrable superannuation entity licensee (reached by declaring that you provide financial services). It applies from , and from the earlier of the next renewal of the third-party contract or to information assets a third party manages.
- Maintain an information security capability commensurate with the size and extent of threats to your information assets, and which enables the continued sound operation of the entity (paragraph 15).
- Maintain that capability with respect to changes in vulnerabilities and threats, including changes to information assets or your business environment (paragraph 17).
- Maintain an information security policy framework commensurate with your exposures to vulnerabilities and threats (paragraph 18).
- Classify your information assets, including those managed by related parties and third parties, by criticality and sensitivity (paragraph 20).
- Have information security controls to protect your information assets, including those managed by related parties and third parties, implemented in a timely manner and commensurate with the vulnerabilities and threats, the criticality and sensitivity of the assets, their life-cycle stage and the potential consequences of an incident (paragraph 21).
- Have robust mechanisms to detect and respond to information security incidents in a timely manner, and maintain plans to respond to the incidents you consider could plausibly occur (paragraphs 23 and 24).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Australian Prudential Regulation Authority, which determines prudential standards for authorised deposit-taking institutions under section 11AF of the Banking Act 1959.
Settledness
- As of
- Open questions
- Does section 11AG of the Banking Act 1959, which is stated for authorised deposit-taking institutions, have an equivalent in the Insurance Act 1973, the Life Insurance Act 1995, the Private Health Insurance (Prudential Supervision) Act 2015 and the Superannuation Industry (Supervision) Act 1993 for the other entities the Prudential Standard reaches?
What this law does
Paragraph 15 of Prudential Standard CPS 234 requires an APRA-regulated entity to maintain an information security capability commensurate with the size and extent of threats to its information assets. Paragraph 18 of the Prudential Standard requires an APRA-regulated entity to maintain an information security policy framework commensurate with its exposures to vulnerabilities and threats.
Paragraph 21 of the Prudential Standard requires an APRA-regulated entity to have information security controls to protect its information assets, including those managed by related parties and third parties. The Prudential Standard applies to all APRA-regulated entities, among them authorised deposit-taking institutions, general insurers, life companies, private health insurers and RSE licensees.
The Prudential Standard is made under section 11AF of the Banking Act 1959, section 32 of the Insurance Act 1973, section 230A of the Life Insurance Act 1995, section 92 of the Private Health Insurance (Prudential Supervision) Act 2015 and section 34C of the Superannuation Industry (Supervision) Act 1993. The Prudential Standard commences on .
Section 11AG of the Banking Act 1959 requires an authorised deposit-taking institution to which a prudential standard applies to comply with the standard.
When LexLint raises it
When your app profile says your app provides financial services.