CPS 234 · Roles and responsibilities
Para 13
Board ultimately responsible for information security
frameworkAPRA CPS 234 Information Security
sectionRoles and responsibilities
csf 2.0GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06 GV.RR-01 GV.RR-02 GV.RR-03
topicsRisk Management, Roles & Responsibilities
frameworks0 10 2
Official textThe Board of an APRA-regulated entity (Board) is ultimately responsible for the information security of the entity. The Board must ensure that the entity maintains information security in a manner commensurate with the size and extent of threats to its information assets, and which enables the continued sound operation of the entity.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RM-01GV.RM-02GV.RM-03GV.RM-06GV.RR-01GV.RR-02GV.RR-03 | Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained… | Editorial | Same topic: Risk Management, Roles & Responsibilities (editorial pick) |
| ISO 27001 | A.5.2A.5.4Clause 6.1.1Clause 6.1.3 | Information security roles and responsibilities; Management responsibilities… | Editorial | Same topic: Roles & Responsibilities, Risk Management (editorial pick)6 loosely related (not mappings)A.5.1 Policies for information security Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping |
| CIS v8.1 | CIS 14.1CIS 14.9 | Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training | No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
| SOC 2 | CC1.2CC1.3CC1.5CC3.1CC5.1CC9.1 | Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities… | Editorial | Same topic: Roles & Responsibilities, Risk Management (editorial pick) |
| PCI DSS | 12.1.312.1.412.3.1 | Security roles and responsibilities defined; Executive responsibility for information security assigned… | Editorial | Same topic: Roles & Responsibilities, Risk Management (editorial pick)33 loosely related (not mappings)5.2.3.1 Re-evaluation frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 5.3.2.1 Scan frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 8.6.3 System account passwords protected and changed Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 10.4.2.1 Review frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 25 more in the downloads |
| CMMC | RA.L2-3.11.1 | Risk Assessments | Editorial | Same topic: Risk Management (editorial pick) |
| 800-53 | PM-2PM-9PM-28PM-29PS-9RA-7 | Information Security Program Leadership Role; Risk Management Strategy… | Editorial | Same topic: Roles & Responsibilities, Risk Management (editorial pick) |
| HIPAA | §164.308(a)(1)(ii)(B)§164.308(a)(2) | Risk Management; Assigned Security Responsibility | Editorial | Same topic: Risk Management, Roles & Responsibilities (editorial pick)2 loosely related (not mappings) |
| GDPR | Art.24(1)Art.32(2)Art.37(1)Art.39(1) | Responsibility of the controller; Security of processing… | Editorial | Same topic: Risk Management, Roles & Responsibilities (editorial pick) |
| NIS2 | 1.22.17.1 | Roles, responsibilities and authorities; Risk management framework… | Editorial | Same topic: Roles & Responsibilities, Risk Management (editorial pick)1 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.RM-03: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(a)Art.5(2)(c)Art.5(3)Art.6(1)Art.6(4)Art.6(8)Art.16(1)Art.24(1) | Governance and organisation; Governance and organisation… | Editorial | Same topic: Risk Management, Roles & Responsibilities (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.