APRA CPS 234:2019 Information Security Prudential Standard
APRA CPS 234:2019 Information Security Prudential Standard
CPS 234:2019 is a regulatory standard issued by the Australian Prudential Authority (APRA). The management of cybersecurity is a global risk, and the Australian Prudential Authority has set out requirements to fulfil the associated cyber requirements. This Prudential Standard aims to ensure that an APRA-regulated entity takes measures to be resilient against information security incidents (including cyber attacks) by maintaining an information security capability commensurate with information security vulnerabilities and threats.
The key focus is on the management of third-party IT vendors and applications to ensure they are secure and managed well to minimise the likelihood and impact of information security incidents on the confidentiality, integrity or availability of information assets, including information assets managed by related parties or third parties. The governance framework is aligned to Control Based IT Frameworks such as COBIT and ISO/IEC 27001:2022, where the scope predominantly focuses on the IT department.
What is CPS 234:2019?
The CPS 234:2019 standard is broken down into eight categories, namely:
- Information security capability.
- Policy framework.
- Information assets identification and classification.
- Implementation of information security controls.
- Incident management.
- Testing control effectiveness.
- Internal audit.
- APRA notification.
The CPS 234:2019 information security controls are:
- Vulnerability and threat management, including situational awareness and intelligence
- Information security operations and administration.
- Secure design, architecture and consultation.
- Security testing, including penetration testing.
- Information security reporting and analytics.
- Incident detection and response, including recovery, notification and communication.
- Information security investigation, including preservation of evidence and forensic analysis.
- Information security assurance.
Why does an organisation need CPS 234:2019?
This standard assists organisations by ensuring:
- Measures are taken to be resilient against information security incidents.
- The likelihood and impact of information security incidents on the confidentiality, integrity or availability of information assets, including information assets managed by related parties or third parties is reduced.
The following institutions must adhere to the Prudential Standard CPS 234:2019
- Banks.
- Credit unions.
- Building societies.
- Insurance and reinsurance companies.
- Private health insurers.
- Life insurers.
This Prudential Standard also applies to all institutions defined as:
- Authorised deposit-taking institutions.
- Foreign authorised deposit-taking institutions.
- Non-operating holding companies authorised under the Banking Act.
Organisations or institutions that are exposed to the following threats should implement this standard:
- Payments and card fraud.
- Geo-positional hacking.
- Attacks on financial data.
- Mobile OS/App vulnerabilities.
- Supply chain attacks.
- Attacks on critical infrastructure.
Organisations or institutions should work to understand what their needs are by conducting a diagnostic gap analysis and identifying potential gaps and weaknesses in their current processes that may expose their data properties to malicious parties. This will help them ensure that they have measures in place to maintain the integrity and security of sensitive client data.
Once gaps have been identified, a risk-based plan must be developed and delivered to address these gaps. The organisation’s cyber risk profile is required to be monitored continuously.
What are the Benefits of Implementing CPS 234:2019?
CPS 234:2019 offers an extensive approach to processes such as cybersecurity testing, reporting structures, and response plans and assists organisations develop and maintain resiliency against information security incidents.
The Prudential Standard CPS 234:2019 builds a good foundation for these controls and measures. It also creates a cyber security-specific framework for the financial service industry.
How do I implement CPS 234:2019 in an organisation?
ISO Consulting & Implementation:
We have a range of professional consultants, engineers, and registered auditors to assist in implementing and maintaining your ISO management system. Our industry expertise includes services, telecommunication, manufacturing, construction, engineering services, fast-moving consumer goods, mining, power generation, state owned companies, and government-run organisations. Each of our consultants takes the time to truly understand the processes of your organisation, which will enable them to implement ISO requirements accordingly and effectively. Hiring a consultant and the time spent to implement your ISO management system will pay off in the long run.
WWISE has a 4-Phase Approach:
- Phase 1: Gap Analysis Audit and Information Gathering
- Phase 2: ISO Documentation, Risk Assessment, and Process Mapping
- Phase 3: Implementation and Training
- Phase 4: Certification
At WWISE we provide a fully inclusive solution that includes full turnkey, awareness training, classroom and online training, and mentorship. As a consulting firm, we do not provide certification services. However, we will guide you through the certification process and ensure that your business becomes certified.
Why Choose WWISE to Assist your Organisation:
Certification Process:
An organisation can get certified to a requirement standard. You can implement the standard and get certified by a third-party.
