CPS 234 · Information asset identification and classification
Para 20
Classify information assets by criticality and sensitivity
frameworkAPRA CPS 234 Information Security
sectionInformation asset identification and classification
csf 2.0ID.AM-01 ID.AM-02 ID.AM-04 ID.AM-05 ID.AM-07 ID.AM-08
topicsAsset Management, Data Classification
frameworks0 13 0
Official textAn APRA-regulated entity must classify its information assets, including those managed by related parties and third parties, by criticality and sensitivity. This classification must reflect the degree to which an information security incident affecting an information asset has the potential to affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.AM-01ID.AM-02ID.AM-04ID.AM-05ID.AM-07ID.AM-08 | Inventories of hardware managed by the organization are maintained; Inventories of software, services, and systems managed by the organization are maintained… | Editorial | Same topic: Asset Management, Data Classification (editorial pick) |
| ISO 27001 | A.5.9A.5.11A.5.12A.5.13A.7.14 | Inventory of information and other associated assets; Return of assets… | Editorial | Same topic: Asset Management, Data Classification (editorial pick) |
| CIS v8.1 | CIS 1.1CIS 1.2CIS 1.3CIS 1.4CIS 1.5CIS 2.1CIS 2.3CIS 2.4CIS 3.2CIS 3.7CIS 3.8CIS 16.4 | Establish and Maintain Detailed Enterprise Asset Inventory; Address Unauthorized Assets… | Editorial | Same topic: Asset Management, Data Classification (editorial pick) |
| SOC 2 | C1.1CC6.1 | Identifying and protecting confidential information; Logical access security over information assets | Editorial | Same topic: Data Classification, Asset Management (editorial pick)1 loosely related (not mappings) |
| PCI DSS | 6.3.29.4.212.5.1 | Inventory of custom software and its components; Media classified by data sensitivity… | Editorial | Same topic: Asset Management, Data Classification (editorial pick)25 loosely related (not mappings)6.3.1 Vulnerabilities identified and risk-ranked Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping 11.6.1 Payment page changes and tampering detected Only shares CSF ID.AM-05, ID.AM-08: related, not a mapping 12.8.1 List of third-party service providers kept Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Only shares CSF ID.AM-07: related, not a mapping 3.4.2 PAN copying prevented over remote-access technologies Only shares CSF ID.AM-07: related, not a mapping 6.2.1 Bespoke and custom software developed securely Only shares CSF ID.AM-08: related, not a mapping …and 17 more in the downloads |
| CMMC | CM.L2-3.4.1MP.L2-3.8.4 | System Baselining; Media Markings | Editorial | Same topic: Asset Management, Data Classification (editorial pick)6 loosely related (not mappings) |
| 800-53 | CM-8PM-5RA-2 | System Component Inventory; System Inventory… | Editorial | Same topic: Asset Management, Data Classification (editorial pick)22 loosely related (not mappings)SI-12 Information Management and Retention Only shares CSF ID.AM-07, ID.AM-08: related, not a mapping …and 14 more in the downloads |
| HIPAA | §164.310(d)§164.310(d)(2)(iii) | Device and Media Controls; Accountability | Editorial | Same topic: Asset Management (editorial pick)19 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF ID.AM-02, ID.AM-04, ID.AM-08: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF ID.AM-02, ID.AM-04: related, not a mapping …and 11 more in the downloads |
| GDPR | Art.30(1) | Records of processing activities | Editorial | Same topic: Asset Management (editorial pick)1 loosely related (not mappings) |
| NIS2 | 12.112.4 | Asset classification; Asset inventory | Editorial | Same topic: Data Classification, Asset Management (editorial pick)1 loosely related (not mappings) |
| Essential Eight | ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the… | Editorial | Same topic: Asset Management (editorial pick) |
| DORA | Art.8(1)Art.8(4)Art.8(6) | Identification; Identification… | Editorial | Same topic: Asset Management, Data Classification (editorial pick) |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Asset Management (editorial pick)1 loosely related (not mappings) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.