Where does your CPS 234 position actually stand?

¶13Does your Board formally own information security, and is that recorded (for example in a charter, terms of reference or minutes)?

¶14Are the information security roles of the Board, senior management, governing bodies and individuals defined in writing?

¶15Do you maintain an information security capability that matches the size and extent of the threats to your information assets?

¶16Do you assess the information security capability of related parties and third parties that manage your information assets?

¶17Do you actively keep that capability up to date as threats, vulnerabilities and your information assets change?

¶18Do you have an information security policy framework sized to your vulnerabilities and threats?

¶19Does that framework give direction to everyone with an obligation under it: staff, contractors, related parties and third parties?

¶20Are your information assets, including those managed by related or third parties, classified by criticality and sensitivity?

¶21Are your controls sized against the threats, the criticality and sensitivity of each asset, its life-cycle stage and the consequences of an incident?

¶22Where a related or third party manages your information assets, do you evaluate the design of its controls?

¶23Do you have robust mechanisms to detect and respond to information security incidents in a timely way?

¶24Do you maintain response plans for the incidents you consider could plausibly occur?

¶25Do those plans run from detection to post-incident review, and include escalation to the Board where needed?

¶26Are the response plans reviewed and tested every year?

¶27Do you run a systematic testing program, with its nature and frequency set by the five factors in paragraph 27 (not just an annual penetration test)?

¶28Where you rely on a third party’s control testing, do you assess whether it is commensurate with those same factors?

¶29Are testing deficiencies that cannot be remediated in a timely manner escalated to the Board or senior management?

¶30Is testing carried out by appropriately skilled and functionally independent specialists?

¶31Do you review whether the testing program itself is sufficient, at least every year?

¶32Does internal audit review both the design and the operating effectiveness of your information security controls?

¶33Is that assurance given by people with appropriate information security skills?

¶34Does internal audit assess the information security assurance provided by related and third parties you rely on?

¶35Would you notify APRA within 72 hours of becoming aware of a material information security incident, or one notified to another regulator?

¶36Would you notify APRA within 10 business days of becoming aware of a material control weakness you cannot remediate in time?