CPS 234 para 13 Board accountability for information security
The Board carries final accountability for the entity's information security. It has to make sure security is kept at a level that matches how large and widespread the threats to the entity's information assets are, and that lets the business keep operating soundly. For an RSE licensee the Board means its directors or individual trustees; for a foreign ADI it means the senior officer outside Australia.
Source: APRA CPS 234, CPS 234 para 13. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open APRA CPS 234 in the compliance library.
Applies to APRA-regulated entities.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Board and risk committee minutes recording receipt, challenge and decisions on information security reporting · Policy repository / GRC workspace
- Periodic CISO or CIO report to the Board covering threat landscape, capability gaps and remediation status · Policy repository / GRC workspace
- Board training or briefing records on cyber and information security · HR system / LMS
governing documentDocuments that govern the control
- Board charter or terms of reference naming information security as a Board accountability · Policy repository / GRC workspace
- Board-approved information security strategy and risk appetite statement for cyber risk · Policy repository / GRC workspace
First move
Common gaps auditors find
- Board receives security updates only as a line in an IT report with no recorded discussion or challenge
- Accountability delegated in practice to the CIO with no evidence the Board tests whether security keeps pace with threats
- No Board-level view of whether security spend and capability match the entity's threat exposure
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCPS 234 para 14 Information security roles and responsibilities defined