Document ID: chunk:federal_register_of_legislation:F2018L01745:body:0:p7
Version: federal_register_of_legislation:F2018L01745
Segment Type: other
Provision Reference: 
Character Range: 17775–20604

APRA as soon as possible and, in any case, no later than 10 business days, after it becomes aware of a material information security control weakness which the entity expects it will not be able to remediate in a timely manner.
    [1]  For the purposes of this Prudential Standard, an 'RSE licensee's business operations' includes all activities of an RSE licensee (including the activities of each RSE of which it is the licensee), and all other activities of the RSE licensee to the extent that they are relevant to, or may impact on, its activities as an RSE licensee.
    [2]   Where a Level 2 group operates within a Level 3 group, a requirement expressed as applying to a Head of a group is to be read as applying to the Level 3 Head.
    [3]  Refer to subsection 11AF(2) of the Banking Act, subsection 32(3D) of the Insurance Act, subsection 230A(4) of the Life Insurance Act, subsection 92(4) of the PHIPS Act and subsection 34C(5) of the SIS Act.
    [4]  For an RSE licensee, a reference to the Board is to be read as a reference to the Board of directors or group of individual trustees of an RSE licensee, as applicable. 'Group of individual trustees' has the meaning given in subsection 10(1) of the SIS Act.
    [5]  A reference to the Board in the case of a foreign ADI, is a reference to the senior officer outside Australia.
    [6]  For the purposes of this Prudential Standard, governing bodies and individuals includes committees, working groups and forums.
    [7]  For the avoidance of doubt, paragraph 16 of this Prudential Standard applies to all information assets managed by related parties and third parties, not only those captured under agreements with service providers of outsourced material business activities under Prudential Standard CPS 231 Outsourcing or Prudential Standard SPS 231 Outsourcing.
    [8]  For the purpose of paragraph 19 of this Prudential Standard, parties includes governing bodies and individuals with responsibilities referred to in paragraph 14, as well as all other staff, contractors, consultants, related parties, third parties and customers.
    [9]  The use of the term 'life-cycle' in this context refers to the process from planning and design through to decommissioning and disposal of an information asset.
    [10]  For the avoidance of doubt, paragraph 22 of this Prudential Standard applies to all information assets managed by related parties and third parties, not only those captured under agreements with service providers of outsourced material business activities under Prudential Standard CPS 231 Outsourcing or Prudential Standard SPS 231 Outsourcing.

    [11]  Also referred to as an 'untrusted' environment.
    [12]  For the avoidance of doubt, paragraph 28 of this Prudential Standard applies to all information assets managed by related parties