Call us now:
The Australian Prudential Regulatory Body. A regulator who provides oversight of Australian regulated financial entities, covering local and foreign deposit takers, life, health and direct insurers has released a standard (CPS 243), to
1. Clearly define the information security-related roles and responsibilities of the Board, senior management, governing bodies and individuals.
2. Maintain an information security capability commensurate with the size and extent of threats to its information assets, and which enables the continued
sound operation of the entity.
3. Implement controls to protect its information assets commensurate with the criticality and sensitivity of those information assets, and undertake systematic testing and assurance regarding the effectiveness of those controls.
4. Notify APRA of material information security incidents.
A nice, simple and concise set of requirements which explicitly sets the responsibility for information security at the board table. Nice to see that they have put controls as a requirement to manage, as it puts the onus on the board table to understand and maintain its controls environment, in line with the size and complexity of the business.
It will be interesting to see how oversight of the regulation takes place and enforced.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6552073179517501440