CPS 234 para 24 Maintain information security response plans
The entity keeps plans for responding to the security incidents it judges could plausibly happen to it (its information security response plans).
Source: APRA CPS 234, CPS 234 para 24. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open APRA CPS 234 in the compliance library.
Applies to APRA-regulated entities.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Version history of the plans · Policy repository / GRC workspace
periodic reviewEvidence produced at each review
- Scenario analysis showing which incident types were judged plausible · Document repository
- Plan ownership and approval records · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Incident response plan and scenario-specific playbooks (for example ransomware, data breach, third-party compromise) · Vendor register / contract repository
- Contact lists and retainer agreements for forensic and legal support · Vendor register / contract repository
First move
Common gaps auditors find
- A single generic plan with no playbooks for the entity's most plausible scenarios
- Plausible scenarios never formally identified
- Plans out of date with staff who have left still listed as contacts
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCPS 234 para 23 Detect and respond to incidents promptly · CPS 234 para 25 Response plan content: stages and escalation