CPS 234 · Roles and responsibilities
Para 14
Define information security roles and responsibilities
frameworkAPRA CPS 234 Information Security
sectionRoles and responsibilities
csf 2.0GV.RR-01 GV.RR-02 GV.RR-03
topicsRoles & Responsibilities
frameworks0 9 3
Official textAn APRA-regulated entity must clearly define the information security-related roles and responsibilities of the Board, senior management, governing bodies and individuals with responsibility for decision-making, approval, oversight, operations and other information security functions.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RR-01GV.RR-02GV.RR-03 | Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving; Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced… | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| ISO 27001 | A.5.2A.5.4 | Information security roles and responsibilities; Management responsibilities | Editorial | Same topic: Roles & Responsibilities (editorial pick)4 loosely related (not mappings) |
| CIS v8.1 | CIS 14.1CIS 14.9 | Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training | No mapping. Only shares CSF GV.RR-01, GV.RR-02: related, not a mapping | |
| SOC 2 | CC1.2CC1.3CC1.5 | Board independence and oversight of internal control; Structures, reporting lines, authorities and responsibilities… | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| PCI DSS | 12.1.312.1.4 | Security roles and responsibilities defined; Executive responsibility for information security assigned | Editorial | Same topic: Roles & Responsibilities (editorial pick)15 loosely related (not mappings)3.1.2 Roles for protecting stored account data assigned Only shares CSF GV.RR-02: related, not a mapping 4.1.2 Roles for protecting data in transit assigned Only shares CSF GV.RR-02: related, not a mapping 6.1.2 Roles for secure systems and software assigned Only shares CSF GV.RR-02: related, not a mapping 6.2.2 Developers trained in secure software development Only shares CSF GV.RR-01: related, not a mapping …and 7 more in the downloads |
| CMMC | — | No requirement | No mapping in our data | No mapping in our data. |
| 800-53 | PM-2PM-29PS-9 | Information Security Program Leadership Role; Risk Management Program Leadership Roles… | Editorial | Same topic: Roles & Responsibilities (editorial pick)5 loosely related (not mappings) |
| HIPAA | §164.308(a)(2) | Assigned Security Responsibility | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| GDPR | Art.37(1)Art.39(1) | Designation of the data protection officer; Tasks of the data protection officer | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| NIS2 | 1.2 | Roles, responsibilities and authorities | Editorial | Same topic: Roles & Responsibilities (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(c)Art.5(3)Art.6(4) | Governance and organisation; Governance and organisation… | Editorial | Same topic: Roles & Responsibilities (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.