APRA CPS 234: the evidence behind each requirement

24 paragraphs. For each, the artefacts auditors commonly ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Applies to APRA-regulated entities.

Roles and responsibilities (paras 13 to 14)

CPS 234 para 13Board accountability for information security hard CPS 234 para 14Information security roles and responsibilities defined hard

Information security capability (paras 15 to 17)

CPS 234 para 15Maintain an information security capability hard CPS 234 para 16Assess the security capability of related and third parties hard CPS 234 para 17Keep capability current as threats and assets change hard

Policy framework (paras 18 to 19)

CPS 234 para 18Maintain an information security policy framework hard CPS 234 para 19Policy direction to everyone with a security obligation hard

Information asset identification and classification (para 20)

CPS 234 para 20Classify information assets by criticality and sensitivity hard

Implementation of controls (paras 21 to 22)

CPS 234 para 21Implement controls proportionate to risk and lifecycle hard CPS 234 para 22Evaluate the design of third-party controls hard

Incident management (paras 23 to 26)

CPS 234 para 23Detect and respond to incidents promptly moderate CPS 234 para 24Maintain information security response plans hard CPS 234 para 25Response plan content: stages and escalation hard CPS 234 para 26Annual review and testing of response plans hard

Testing control effectiveness (paras 27 to 31)

CPS 234 para 27Systematic testing of control effectiveness hard CPS 234 para 28Assess reliance on third-party control testing hard CPS 234 para 29Escalate control deficiencies that cannot be fixed promptly hard CPS 234 para 30Skilled and independent testers hard CPS 234 para 31Review the sufficiency of the testing program hard

Internal audit (paras 32 to 34)

CPS 234 para 32Internal audit review of control design and operation hard CPS 234 para 33Skilled personnel for control assurance hard CPS 234 para 34Internal audit assessment of third-party assurance hard

APRA notification (paras 35 to 36)

CPS 234 para 35Notify APRA of material incidents within 72 hours hard CPS 234 para 36Notify APRA of material control weaknesses within 10 business days hard