Now live: New information security requirements and Board responsibility for financial services entities

Financial services in Australia are now subject to increased cyber-security and information security regulation.

Effective 1 July 2019, APRA-regulated entities must ensure their information security capabilities comply with a new prudential standard issued by the Australian Prudential Regulatory Authority (APRA), CPS 234. These enhanced information security obligations seek to ensure the continued sound operation of entities holding sensitive information despite the rise and variety of information security threats, vulnerabilities and incidents. Notifications of material information incidents must be provided to APRA within 72 hours.

Who must comply?

CPS 234 applies to APRA-regulated entities. This sweepingly broad category includes authorised deposit-taking institutions (banks, credit unions, building societies), general insurers, life companies including eligible foreign life insurance companies, private health insurers and registrable superannuation