Document ID: chunk:federal_register_of_legislation:F2018L01745:body:0:p5
Version: federal_register_of_legislation:F2018L01745
Segment Type: other
Provision Reference: 
Character Range: 11587–15051

incident affecting those assets.[7]
17.         An APRA-regulated entity must actively maintain its information security capability with respect to changes in vulnerabilities and threats, including those resulting from changes to information assets or its business environment.

Policy framework
18.         An APRA-regulated entity must maintain an information security policy framework commensurate with its exposures to vulnerabilities and threats.
19.         An APRA-regulated entity's information security policy framework must provide direction on the responsibilities of all parties who have an obligation to maintain information security.[8]

Information asset identification and classification
20.         An APRA-regulated entity must classify its information assets, including those managed by related parties and third parties, by criticality and sensitivity. This classification must reflect the degree to which an information security incident affecting an information asset has the potential to affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers.

Implementation of controls
21.         An APRA-regulated entity must have information security controls to protect its information assets, including those managed by related parties and third parties, that are implemented in a timely manner and that are commensurate with:
(a)          vulnerabilities and threats to the information assets;
(b)          the criticality and sensitivity of the information assets;
(c)          the stage at which the information assets are within their life-cycle;[9] and
(d)          the potential consequences of an information security incident.
22.         Where an APRA-regulated entity's information assets are managed by a related party or third party, the APRA-regulated entity must evaluate the design of that party's information security controls that protects the information assets of the APRA-regulated entity.[10]

Incident management
23.         An APRA-regulated entity must have robust mechanisms in place to detect and respond to information security incidents in a timely manner.
24.         An APRA-regulated entity must maintain plans to respond to information security incidents that the entity considers could plausibly occur (information security response plans).
25.         An APRA-regulated entity's information security response plans must include the mechanisms in place for:
(a)          managing all relevant stages of an incident, from detection to post-incident review; and
(b)          escalation and reporting of information security incidents to the Board, other governing bodies and individuals responsible for information security incident management and oversight, as appropriate.
26.         An APRA-regulated entity must annually review and test its information security response plans to ensure they remain effective and fit-for-purpose.

Testing control effectiveness
27.         An APRA-regulated entity must test the effectiveness of its information security controls through a systematic testing program. The nature and frequency of the systematic testing must be commensurate with:
(a)          the rate at which the vulnerabilities and threats change;
(b)          the criticality and sensitivity of the information asset;
(c)          the consequences of an information security incident;
(d)          the risks associated with exposure to