CPS 234 · Testing control effectiveness
Para 27
Systematic testing programme for control effectiveness
frameworkAPRA CPS 234 Information Security
sectionTesting control effectiveness
csf 2.0GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06 ID.RA-01 ID.RA-08
topicsRisk Management, Vulnerability Mgmt
frameworks0 13 0
Official textAn APRA-regulated entity must test the effectiveness of its information security controls through a systematic testing program. The nature and frequency of the systematic testing must be commensurate with:
(a) the rate at which the vulnerabilities and threats change;
(b) the criticality and sensitivity of the information asset;
(c) the consequences of an information security incident;
(d) the risks associated with exposure to environments where the APRA-regulated entity is unable to enforce its information security policies; and
(e) the materiality and frequency of change to information assets.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
(a) the rate at which the vulnerabilities and threats change;
(b) the criticality and sensitivity of the information asset;
(c) the consequences of an information security incident;
(d) the risks associated with exposure to environments where the APRA-regulated entity is unable to enforce its information security policies; and
(e) the materiality and frequency of change to information assets.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.RM-01GV.RM-02GV.RM-03GV.RM-06ID.RA-01ID.RA-08 | Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| ISO 27001 | A.8.8Clause 6.1.1Clause 6.1.3 | Management of technical vulnerabilities; General… | Editorial | Same topic: Vulnerability Mgmt, Risk Management (editorial pick)2 loosely related (not mappings)A.5.1 Policies for information security Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06, ID.RA-08: related, not a mapping |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process… | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| SOC 2 | CC3.1CC5.1CC7.1CC9.1 | Objectives specified clearly enough to identify risks; Control activities that mitigate risks… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| PCI DSS | 6.3.111.3.111.3.212.3.1 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months… | Editorial | Same topic: Vulnerability Mgmt, Risk Management (editorial pick)20 loosely related (not mappings)5.2.3.1 Re-evaluation frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 5.3.2.1 Scan frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 6.3.3 Security patches installed promptly Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 8.6.3 System account passwords protected and changed Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 10.4.2.1 Review frequency set by targeted risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 11.3.1.1 Lower-ranked vulnerabilities handled by risk analysis Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 12 more in the downloads |
| CMMC | RA.L2-3.11.1RA.L2-3.11.2RA.L2-3.11.3 | Risk Assessments; Vulnerability Scan… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick)6 loosely related (not mappings) |
| 800-53 | CA-8PM-9PM-28RA-5RA-7 | Penetration Testing; Risk Management Strategy… | Editorial | Same topic: Vulnerability Mgmt, Risk Management (editorial pick)12 loosely related (not mappings)PM-30 Supply Chain Risk Management Strategy Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 4 more in the downloads |
| HIPAA | §164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B)§164.308(a)(8) | Risk Analysis; Risk Management… | Editorial | Same topic: Vulnerability Mgmt, Risk Management (editorial pick)3 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.RA-01: related, not a mapping |
| GDPR | Art.24(1)Art.32(1)(d)Art.32(2) | Responsibility of the controller; Security of processing… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| NIS2 | 2.16.56.107.1 | Risk management framework; Security testing… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick)1 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF GV.RM-03: related, not a mapping |
| Essential Eight | ISM-1698ISM-1699ISM-1701ISM-1702ISM-1807ISM-1808 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates…… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)23 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF ID.RA-01: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01: related, not a mapping …and 15 more in the downloads |
| DORA | Art.5(2)(a)Art.6(1)Art.6(8)Art.8(2)Art.16(1)Art.24(1)Art.25(1)Art.26(1)Art.27(1) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Risk Management, Vulnerability Mgmt (editorial pick) |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.