This Prudential Standard aims to ensure that an APRA-regulated entity takes measures to be resilient against information security incidents (including cyber-attacks) by maintaining an information security capability commensurate with information security vulnerabilities and threats.
It requires organisation’s to significantly raise their information security capabilities commensurate with the evolving size and extent of the threats to their assets.
Obligations on entities under CPS 234 include:
(Haynes Royal Commission Report 2018)
APRA’s new mandatory regulation specifies new cyber security requirements for APRA regulated entities and brings to the forefront the importance of strong cyber security in the information age.
The key objective is to minimise the likelihood and impact of information security incidents on the confidentiality, integrity or availability of information assets, including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that the entity maintains its information security.
CPS 234 applies to all APRA-regulated entities. These include:
The cyber landscape is continually evolving. CPS 234 is a direct response to this changing environment. Today’s top threats include:
Thanks to our highly experienced and trained people, we can help your organisation meet the CPS 234 compliance obligations.
It’s essential that an organisation understands where they are in relation to the security of their organisation. This is where an Enterprise Cyber Security Review (ECSR) is beneficial.
An Incident Response Readiness Assessment (IRRA) provides you and your stakeholders a clear picture of current capabilities. Importantly, it will identify improvements and provide a roadmap of prioritised objectives.
We can assist with the development of a vulnerability management process through to the selection of appropriate supporting tools.
Sense of Security offers that most comprehensive range of testing services in the market. APRA regulated entities generally have large footprint environments both at the network and application layer.
