Document ID: chunk:federal_register_of_legislation:F2018L01745:body:0:p6
Version: federal_register_of_legislation:F2018L01745
Segment Type: other
Provision Reference: 
Character Range: 14746–17994

systematic testing must be commensurate with:
(a)          the rate at which the vulnerabilities and threats change;
(b)          the criticality and sensitivity of the information asset;
(c)          the consequences of an information security incident;
(d)          the risks associated with exposure to environments where the APRA-regulated entity is unable to enforce its information security policies;[11] and
(e)          the materiality and frequency of change to information assets.
28.         Where an APRA-regulated entity's information assets are managed by a related party or a third party, and the APRA-regulated entity is reliant on that party's information security control testing, the APRA-regulated entity must assess whether the nature and frequency of testing of controls in respect of those information assets is commensurate with paragraphs 27(a) to 27(e) of this Prudential Standard.[12]
29.         An APRA-regulated entity must escalate and report to the Board or senior management any testing results that identify information security control deficiencies that cannot be remediated in a timely manner.
30.         An APRA-regulated entity must ensure that  testing is conducted by appropriately skilled and functionally independent specialists.
31.         An APRA-regulated entity must review the sufficiency of the testing program at least annually or when there is a material change to information assets or the business environment.

Internal audit
32.         An APRA-regulated entity's internal audit activities must include a review of the design and operating effectiveness of information security controls, including those maintained by related parties and third parties (information security control assurance).
33.         An APRA-regulated entity must ensure that the information security control assurance is provided by personnel appropriately skilled in providing such assurance.
34.         An APRA-regulated entity's internal audit function must assess the information security control assurance provided by a related party or third party where:
(a)          an information security incident affecting the information assets has the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; and
(b)          internal audit intends to rely on the information security control assurance provided by the related party or third party.[13]

APRA notification
35.         An APRA-regulated entity must notify APRA as soon as possible and, in any case, no later than 72 hours, after becoming aware of an information security incident that:
(a)          materially affected, or had the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; or
(b)          has been notified to other regulators, either in Australia or other jurisdictions.[14]
36.         An APRA-regulated entity must notify APRA as soon as possible and, in any case, no later than 10 business days, after it becomes aware of a material information security control weakness which the entity expects it will not be able to remediate in a timely