November 07, 2018

APRA has released the final version of its prudential standard focused on information security management. The new Prudential Standard CPS 234 Information Security will shore up APRA-regulated entities’ resilience against information security incidents (including cyber-attacks) and their ability to respond swiftly and effectively in the event of a breach. Following extensive consultation with the industry, APRA also published a Response to Submissions paper outlining the final form of the standard. This Prudential Standard commences on July 01, 2019.

Where an APRA-regulated entity’s information assets are managed by a third party, the requirements in this Prudential Standard will apply in relation to those information assets from the earlier of the next renewal date of the contract with the third party or July 01, 2020. This prudential standard will apply to APRA-regulated entities, including authorized deposit-taking institutions, general insurers, life insurers, private health insurers, licensees of registrable superannuation entities (RSE licensees), and authorized or registered non-operating holding companies. CPS 234 requires APRA-regulated entities to:

  • Clearly define information-security related roles and responsibilities
  • Maintain an information security capability commensurate with the size and extent of threats to their information assets
  • Implement controls to protect information assets and undertake regular testing and assurance of the effectiveness of controls
  • Promptly notify APRA of material information security incidents

APRA first released a discussion paper in March outlining the intended requirements of the new prudential standard. Industry was supportive of the intent and direction of CPS 234. APRA agreed to make several amendments, including clarifying requirements for information assets managed by third parties and modifying the timeframes for notifying APRA of information security incidents and material information security control weaknesses. To help entities fulfill their requirements, APRA will shortly update the Prudential Practice Guide CPG 234 on Management of Information and Information Technology. 

 

Related Links

Effective Date: July 01, 2019/July 01, 2020

Keywords: Asia Pacific, Australia, Banking, Insurance, CPS 234, Cyber Risk, Regtech, Prudential Standard, APRA

Related Articles
News

EBA Report Assesses Regulatory Framework for Fintech Activities

EBA published the findings of its analysis on the regulatory framework applicable to fintech firms when accessing the market.

July 18, 2019 WebPage Regulatory News
News

OSFI Revises Capital Requirements for Operational Risk for Banks

OSFI is revising its capital requirements for operational risk, in line with the final Basel III revisions published by BCBS in December 2017.

July 18, 2019 WebPage Regulatory News
News

OSFI Consults on Revised Principles for Management of Liquidity Risk

OSFI proposed revisions to Guideline B-6 on the principles for the management of liquidity risk.

July 18, 2019 WebPage Regulatory News
News

ESMA Guidance on Disclosures for Credit Rating Sustainability Issues

ESMA published the technical advice on sustainability considerations in the credit rating market, along with the final guidelines on disclosure requirements applicable to credit ratings.

July 18, 2019 WebPage Regulatory News
News

FASB Issues Q&A on Estimation of Expected Credit Losses by Firms

FASB issued a second question-and-answer (Q&A) document that addresses more than a dozen frequently asked questions related to the Accounting Standards Update No. 2016-13 titled “Financial Instruments—Credit Losses (Topic 326): Measurement of Credit Losses on Financial Instruments.”

July 17, 2019 WebPage Regulatory News
News

US Agencies Delay Enforcing Volcker Rule Restrictions on Foreign Funds

US Agencies (FDIC, FED, and OCC) announced that they will not take action related to restrictions under the Volcker Rule for certain foreign funds for an additional two years.

July 17, 2019 WebPage Regulatory News
News

SRB Announces SRF Receives Cash Injection, Grows to EUR 33 billion

SRB announced that the Single Resolution Fund (SRF or the Fund) received a cash injection of EUR 7.8 billion from 3,186 institutions in 2019, bringing the total amount in the Fund to about EUR 33 billion.

July 17, 2019 WebPage Regulatory News
News

FASB to Propose to Delay CECL Compliance Deadline for Certain Entities

FASB published a summary of the tentative decisions taken at its Board meeting in July 2019.

July 17, 2019 WebPage Regulatory News
News

IMF Publishes Report on 2019 Article IV Consultation with Vietnam

IMF published its staff report in context of the 2019 Article IV consultation with Vietnam.

July 16, 2019 WebPage Regulatory News
News

European Parliament Elects Next President of European Commission

European Parliament elected Ursula von der Leyen from Germany as the first female President of the next European Commission for a five-year term from November 01, 2019.

July 16, 2019 WebPage Regulatory News
RESULTS 1 - 10 OF 3476