Featured Product

    APRA Expects Boards to Strengthen Ability to Oversee Cyber Resilience

    November 23, 2021

    The Australian Prudential Regulation Authority (APRA) recently completed two pilot initiatives in its 2020-2024 Cyber Security Strategy, which was published in November 2020. These pilots are a technology resilience data collection and an independent assessment of a pilot set of entities’ compliance with CPS 234, the prudential standard on information security. APRA is now publishing insights gained from the two pilots and from its supervisory activities. The insights reinforce APRA’s view that boards need to strengthen their ability to oversee cyber resilience.

    APRA expects boards to have the same level of confidence in reviewing and challenging information security issues as they do when governing other business issues. The pilot independent CPS 234 assessment involved a small sample of banking, insurance, and superannuation entities undergoing an independent assessment against the requirements of CPS 234. The results of the two pilots, together with the outcomes of recent supervisory activities, led APRA to conclude that boards need to play a more active role in: 

    • Reviewing and challenging information reported by management on cyber resilience
    • Ensuring their entities can recover from high-impact cyber-attacks (for example, ransomware)
    • Ensuring information security controls are effective across the supply chain

    APRA notes that it is ultimately the board’s responsibility to ensure that management is fully across the cyber threat they face and, where necessary, takes appropriate action to ensure its entity remains cyber resilient. Over the next couple of years, APRA will continue to roll out the CPS 234 independent assessment process for the remaining entities across the banking, superannuation and insurance industries. APRA intends to share relevant insights with industry from its data collection and other strategic initiatives on cyber security, with a view to lifting practices and enhancing cyber resilience throughout the financial sector.

     

    Related Link: APRA Insights from Pilots

     

    Keywords: Asia Pacific, Australia, Banking, Cyber Risk, CPS 234, Cyber Security Strategy, Governance, ESG, APRA

    Related Articles
    News

    APRA Sets LAC for D-SIBs, Proposes to Enhance Crisis Preparedness

    APRA issued a letter on the loss-absorbing capacity (LAC) requirements for domestic systemically important banks (D-SIBs) and published a discussion paper, along with the proposed the prudential standards on financial contingency planning (CPS 190) and resolution planning (CPS 900).

    December 02, 2021 WebPage Regulatory News
    News

    EC to Review Macro-Prudential Rules while ESRB Assesses Policy Stance

    The European Commission (EC) launched a call for evidence, until March 18, 2022, as part of a comprehensive review of the macro-prudential rules for the banking sector under the Capital Requirements Regulation (CRR) and Directive (CRD IV).

    December 01, 2021 WebPage Regulatory News
    News

    FSB Sets Out Good Practices for Crisis Management Groups

    The Financial Stability Board (FSB) published a report that sets out good practices for crisis management groups.

    November 30, 2021 WebPage Regulatory News
    News

    APRA Penalizes Heritage Bank for Incorrect Reporting of Capital

    The Australian Prudential Regulation Authority (APRA) found that Heritage Bank Limited had incorrectly reported capital because of weaknesses in operational risk and compliance frameworks, although the bank did not breach minimum prudential capital ratios at any point and remains well-capitalized.

    November 29, 2021 WebPage Regulatory News
    News

    OSFI Releases Annual Report 2021-2022

    The Office of the Superintendent of Financial Institutions (OSFI) released the annual report for 2020-2021.

    November 29, 2021 WebPage Regulatory News
    News

    OSFI Updates Timeline for Implementation of Certain Basel Rules

    Through a letter addressed to the banking sector entities, the Office of the Superintendent of Financial Institutions (OSFI) announced deferral of the domestic implementation of the final Basel III reforms from the first to the second quarter of 2023.

    November 29, 2021 WebPage Regulatory News
    News

    EC Defers Adoption of Regulatory Standards for Disclosures Under SFDR

    EIOPA recently published a letter in which EC is informing the European Parliament and Council that it could not adopt the set of draft regulatory technical standards for disclosures under the Sustainable Finance Disclosure Regulation (SFDR) within the stipulated three-month period, given their length and technical detail.

    November 29, 2021 WebPage Regulatory News
    News

    FCA Releases MIFIDPRU Application Forms and Third Set of Rules on IFPR

    The Financial Conduct Authority (FCA) published the third in a series of policy statements that set out rules to introduce the UK Investment Firm Prudential Regime (IFPR), which will take effect on January 01, 2022.

    November 29, 2021 WebPage Regulatory News
    News

    APRA Finalizes Capital Adequacy Standards for Banks

    The Australian Prudential Regulation Authority (APRA) published, along with a summary of its response to the consultation feedback, an information paper that summarizes the finalized capital framework that is in line with the internationally agreed Basel III requirements for banks.

    November 29, 2021 WebPage Regulatory News
    News

    CPMI-IOSCO Seek Comments on Access to Central Clearing and Portability

    The Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) issued a consultative report focusing on access to central counterparty (CCP) clearing and client-position portability.

    November 29, 2021 WebPage Regulatory News
    RESULTS 1 - 10 OF 7751