Document ID: chunk:federal_register_of_legislation:F2018L01745:body:0:p2
Version: federal_register_of_legislation:F2018L01745
Segment Type: other
Provision Reference: 
Character Range: 2771–6162

Superannuation Industry (Supervision) Act 1993.

Schedule

Prudential Standard CPS 234 Information Security comprises the document commencing on the following page.

Prudential Standard CPS 234

Information Security
Objectives and key requirements of this Prudential Standard
This Prudential Standard aims to ensure that an APRA-regulated entity takes measures to be resilient against information security incidents (including cyber-attacks) by maintaining an information security capability commensurate with information security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of information security incidents on the confidentiality, integrity or availability of information assets, including information assets managed by related parties or third parties.
The Board of an APRA-regulated entity is ultimately responsible for ensuring that the entity maintains its information security.
The key requirements of this Prudential Standard are that an APRA-regulated entity must:
     * clearly define the information security-related roles and responsibilities of the Board, senior management, governing bodies and individuals;

     * maintain an information security capability commensurate with the size and extent of threats to its information assets, and which enables the continued sound operation of the entity;

     * implement controls to protect its information assets commensurate with the criticality and sensitivity of those information assets, and undertake systematic testing and assurance regarding the effectiveness of those controls; and

     * notify APRA of material information security incidents.

Authority
     1. This Prudential Standard is made under:
(a)          section 11AF of the Banking Act 1959 (Banking Act);
(b)          section 32 of the Insurance Act 1973 (Insurance Act);
(c)          section 230A of the Life Insurance Act 1995 (Life Insurance Act);
(d)          section 92 of the Private Health Insurance (Prudential Supervision) Act 2015 (PHIPS Act); and
(e)          section 34C of the Superannuation Industry (Supervision) Act 1993 (SIS Act).

Application
2.             This Prudential Standard applies to all 'APRA-regulated entities' defined as:
(a)          authorised deposit-taking institutions (ADIs), including foreign ADIs, and non-operating holding companies authorised under the Banking Act (authorised banking NOHCs);
(b)          general insurers, including Category C insurers, non-operating holding companies authorised under the Insurance Act (authorised insurance NOHCs), and parent entities of Level 2 insurance groups;
(c)          life companies, including friendly societies,  eligible foreign life insurance companies (EFLICs) and non-operating holding companies registered under the Life Insurance Act (registered life NOHCs);
(d)          private health insurers registered under the PHIPS Act; and
(e)          RSE licensees under the SIS Act in respect of their business operations.[1]
3.             The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian branch operations of that entity.
4.             Where an APRA-regulated entity is the 'Head of a group',[2] it must comply with a requirement of this Prudential Standard:
(a)          in its capacity