joseph armstrong augusta Georgia | APRA’s new mandatory Prudential Standard, CPS-234, commenced on 1 July 2019

It specifies new cybersecurity requirements to ensure APRA-regulated entities tighten their cybersecurity against information security incidents (including cyberattacks). But does it go far enough?

The regulation seeks to minimise the likelihood of and impact of information security incidents concerning confidentiality, integrity and information systems, by ensuring information security capability is commensurate with information security vulnerabilities and threats.

patrick armstrong augusta

Cyber Security Consulting reviewed this requirement against requirements set by industry bodies, including ISO 27001, NIST Cyber Security Framework, SOC2 Trust Services Criteria, The Australian Government Information Security Manual (ISM) and PCI DSS. They found the APRA CPS-234 regulation lacked aspects of information security control likely required to protect your organisation.

Comparison of APRA 234 information security requirements to other industry frameworks and standards.

Security policies based solely on CPS-234 may omit critical aspects of an information security management plan necessary to keep your organisation safe.

Cyber Security Consulting, has developed a list of 24 questions to uncover if your organisation is APRA CPS 234 compliant.

joseph armstrong augusta

 This partial list includes questions on supply chain related areas in APRA CPS 234. This is a new focus for APRA, but one which Cyber Security Consulting believes will impact all industry sectors in the future.

Six Questions to ask your Supply Chain	Most likely tool to support an organisation in achieving this
Are security controls that protect your information assets, including those managed by third parties, implemented in a timely manner and are they commensurate with: (a) vulnerabilities and threats to the information assets; (b) the criticality and sensitivity of the information assets; (c) the stage at which the information assets are within their life-cycle; and (d) the potential consequences of an information security incident?	Information Security Policies and/or Framework And Risk Assessment Method
Does the organisation classify its information assets, including those managed by related parties and third parties, by criticality and sensitivity?	Information classification and handling policy and standard
Does your organisation assess the design of information security controls put in place by all third parties that manage information assets on your behalf?	Supply chain governance framework
Does your organisation assess whether third parties who manage your information assets have an appropriate systematic testing program?	Supply chain governance framework And Information Security Testing Framework
Does your organisation have a formal governance process that assesses the information security capability of third parties and related third parties that manage information assets commensurate with the potential consequences of an information security incident affecting those assets?	Supply chain governance framework
Does your organisations internal audit activities include a review of the design and operating effectiveness of information security controls, including those maintained by related parties and third parties (information security control assurance)?	Information Security Control Assurance guideline for audit team

Contact Cyber Security Consulting today for access to our full, detailed guidelines for implementing APRA 234, including templates. Or for general advice on how to deliver APRA CPS-234 as part of your overall information security program.