CPS 234 · Information security capability
Para 16
Assess third parties' information security capability
frameworkAPRA CPS 234 Information Security
sectionInformation security capability
csf 2.0DE.CM-06 GV.SC-01 GV.SC-03 GV.SC-04 GV.SC-05 GV.SC-06 GV.SC-07 GV.SC-09 ID.RA-09 ID.RA-10
topicsSupply Chain Risk, Vendor Risk Mgmt
frameworks0 10 2
Official textWhere information assets are managed by a related party or third party, the APRA-regulated entity must assess the information security capability of that party, commensurate with the potential consequences of an information security incident affecting those assets.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.SC-01GV.SC-03GV.SC-04GV.SC-05GV.SC-06GV.SC-07GV.SC-09ID.RA-09ID.RA-10 | External service provider activities and services are monitored to find potentially adverse events; A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders… | Editorial | Same topic: Vendor Risk Mgmt, Supply Chain Risk (editorial pick) |
| ISO 27001 | A.5.19A.5.20A.5.21A.5.22 | Information security in supplier relationships; Addressing information security within supplier agreements… | Editorial | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)8 loosely related (not mappings)A.5.31 Legal, statutory, regulatory and contractual requirements Only shares CSF GV.SC-05, GV.SC-06, GV.SC-07: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-04, GV.SC-07, GV.SC-09: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.SC-05, GV.SC-06: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 8.1 Operational planning and control Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping |
| CIS v8.1 | CIS 15.1CIS 15.2CIS 15.3CIS 15.4CIS 15.5CIS 15.6CIS 15.7 | Establish and Maintain an Inventory of Service Providers; Establish and Maintain a Service Provider Management Policy… | Editorial | Same topic: Vendor Risk Mgmt, Supply Chain Risk (editorial pick) |
| SOC 2 | CC9.2 | Managing vendor and business partner risk | Editorial | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| PCI DSS | 6.3.212.8.112.8.212.8.312.8.412.8.5 | Inventory of custom software and its components; List of third-party service providers kept… | Editorial | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)17 loosely related (not mappings)6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09…: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-01, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping 11.6.1 Payment page changes and tampering detected Only shares CSF GV.SC-01, GV.SC-03, GV.SC-07, GV.SC-09: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07: related, not a mapping 12.9.2 Service providers support customer compliance requests Only shares CSF GV.SC-01, GV.SC-05, GV.SC-07: related, not a mapping 1.2.3 Accurate network diagram maintained Only shares CSF GV.SC-01, GV.SC-06: related, not a mapping …and 9 more in the downloads |
| CMMC | RA.L2-3.11.1CA.L2-3.12.3CM.L2-3.4.9SI.L2-3.14.6 | Risk Assessments; Security Control Monitoring… | No mapping. Only shares CSF GV.SC-03, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping+1 more loosely related (not mappings) | |
| 800-53 | PM-30SA-4SA-9SR-2SR-3SR-6SR-11 | Supply Chain Risk Management Strategy; Acquisition Process… | Editorial | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| HIPAA | §164.308(b)(1)§164.314(a) | Business Associate Contracts and Other Arrangements; Business Associate Contracts or Other Arrangements | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)33 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF DE.CM-06, GV.SC-04, GV.SC-05, GV.SC-06…: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-06, GV.SC-03: related, not a mapping …and 25 more in the downloads |
| GDPR | Art.28(1)Art.28(3) | Processor; Processor | Editorial | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| NIS2 | 5.15.26.1 | Supply chain security policy; Directory of suppliers and service providers… | Editorial | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.28(2)Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.29(1)Art.29(2)Art.30(2)Art.30(3) | General principles; General principles… | Editorial | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.