Document ID: chunk:federal_register_of_legislation:F2018L01745:body:0:p4
Version: federal_register_of_legislation:F2018L01745
Segment Type: other
Provision Reference: 
Character Range: 8428–11912

insurance group as defined in GPS 001.

Adjustments and exclusions
11.         APRA may adjust or exclude a specific prudential requirement in this Prudential Standard in relation to an APRA-regulated entity.[3]

Definitions
12.         The following definitions are used in this Prudential Standard:
(a)          availability refers to accessibility and usability when required;
(b)          confidentiality refers to access being restricted only to those authorised;
(c)          criticality refers to the potential impact of a loss of availability;
(d)          information asset means information and information technology, including software, hardware and data (both soft and hard copy);
(e)          information security means the preservation of an information asset's confidentiality, integrity and availability;
(f)           information security capability means the totality of resources, skills and controls which provide the ability and capacity to maintain information security;
(g)          information security control means a prevention, detection or response measure to reduce the likelihood or impact of an information security incident;
(h)          information security incident means an actual or potential compromise of information security;
(i)            information security policy framework means the totality of policies, standards, guidelines and procedures pertaining to information security;
(j)            information security threat (threat) is a circumstance or event that has the potential to exploit an information security vulnerability;
(k)          information security vulnerability (vulnerability) is a weakness in an information asset or information security control that could be exploited to compromise information security;
(l)            integrity refers to completeness, accuracy and freedom from unauthorised change or usage; and
(m)        sensitivity means the potential impact of a loss of confidentiality or integrity.

Roles and responsibilities

13.         The Board[4] of an APRA-regulated entity (Board) is ultimately responsible for the information security of the entity. The Board must ensure that the entity maintains information security in a manner commensurate with the size and extent of threats to its information assets, and which enables the continued sound operation of the entity.[5]
14.         An APRA-regulated entity must clearly define the information security-related roles and responsibilities of the Board, senior management, governing bodies and individuals with responsibility for decision-making, approval, oversight, operations and other information security functions.[6]

Information security capability
15.         An APRA-regulated entity must maintain an information security capability commensurate with the size and extent of threats to its information assets, and which enables the continued sound operation of the entity.
16.         Where information assets are managed by a related party or third party, the APRA-regulated entity must assess the information security capability of that party, commensurate with the potential consequences of an information security incident affecting those assets.[7]
17.         An APRA-regulated entity must actively maintain its information security capability with respect to changes in vulnerabilities and threats, including those resulting from changes to information assets or its business environment.

Policy framework
18.         An APRA-regulated