The initial tranche of APRA’s independent tripartite cyber assessment, which assessed around a quarter of the authority’s regulated entities, has highlighted several concerning gaps across the industry.
The independent tripartite cyber assessment – the largest study of its kind to be conducted by the prudential regulator – required APRA’s regulated entities to appoint an independent auditor to assess their compliance with CPS 234 Information Security (CPS 234), a prudential standard which ensures entities have baseline prevention, detection, and response capability to withstand cyber security threats.
APRA said it will increase its supervisory oversight where gaps are identified and breach reporting is undertaken, to ensure entities remediate cyber resilience deficiencies and meet their CPS 234 obligations.
The first round of assessments exposed the following control gaps:
For more details regarding the findings, including what actions entities should take to address the gaps, visit the APRA website.
More than 300 banks, insurers, and superannuation trustees will have participated in the APRA’s assessment by the end of 2023. The second and third tranches are currently ongoing, with the fourth and final tranche to be rolled out later in the year.
“APRA encourages every entity to review those common weaknesses outlined above, along with the prudential standard itself, and incorporate relevant strategies and plans to address shortfalls in their cybersecurity controls and governance policies,” the regulator said in a statement.
“APRA will continue to work with those entities that do not sufficiently meet CPS234 requirements, and will further engage with the industry to lift the benchmark for cyber resilience across the Australian financial services industry.”
Use the comment section below to tell us how you felt about this.
