CPS 234 · Policy framework
Para 19
Policies direct everyone with security obligations
frameworkAPRA CPS 234 Information Security
sectionPolicy framework
csf 2.0GV.PO-01 GV.PO-02
topicsGovernance Policy
frameworks0 9 4
Official textAn APRA-regulated entity's information security policy framework must provide direction on the responsibilities of all parties who have an obligation to maintain information security.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.PO-01GV.PO-02 | Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced; Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission | Editorial | Same topic: Governance Policy (editorial pick) |
| ISO 27001 | A.5.1A.5.37Clause 5.2 | Policies for information security; Documented operating procedures… | Editorial | Same topic: Governance Policy (editorial pick) |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC1.1CC5.3 | Commitment to integrity and ethical values; Control activities deployed through policies and procedures | Editorial | Same topic: Governance Policy (editorial pick) |
| PCI DSS | 12.1.112.1.2 | Information security policy established and published; Security policy reviewed at least annually | Editorial | Same topic: Governance Policy (editorial pick)14 loosely related (not mappings)1.1.1 Network security policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 2.1.1 Secure configuration policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 3.1.1 Stored account data policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 4.1.1 Data-in-transit policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 5.1.1 Anti-malware policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 6.1.1 Secure systems and software policies documented Only shares CSF GV.PO-02: related, not a mapping 7.1.1 Access restriction policies documented and kept current Only shares CSF GV.PO-02: related, not a mapping 8.1.1 Identification and authentication policies documented Only shares CSF GV.PO-02: related, not a mapping …and 6 more in the downloads |
| CMMC | — | No requirement | No mapping in our data | No mapping in our data. |
| 800-53 | PL-1PM-1 | Policy and Procedures; Information Security Program Plan | Editorial | Same topic: Governance Policy (editorial pick)18 loosely related (not mappings)…and 10 more in the downloads |
| HIPAA | §164.316(a)§164.316(b)(2)(iii) | Policies and Procedures; Updates | Editorial | Same topic: Governance Policy (editorial pick)21 loosely related (not mappings)§164.308(a)(1) Security Management Process Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(4) Information Access Management Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF GV.PO-01, GV.PO-02: related, not a mapping …and 13 more in the downloads |
| GDPR | Art.24(2) | Responsibility of the controller | Editorial | Same topic: Governance Policy (editorial pick) |
| NIS2 | 1.1 | Policy on the security of network and information systems | Editorial | Same topic: Governance Policy (editorial pick)1 loosely related (not mappings)6.1 Security in acquisition of ICT services, ICT systems or ICT products Only shares CSF GV.PO-02: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Governance Policy (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.