Review the testing programme at least annually

frameworkAPRA CPS 234 Information Security sectionTesting control effectiveness csf 2.0GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06 topicsRisk Management frameworks0 10 3

Official textAn APRA-regulated entity must review the sufficiency of the testing program at least annually or when there is a material change to information assets or the business environment.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/

gap from CPS 234 → gap to CPS 234 →

Wrong or missing mapping? Report it

Equivalents of Para 31 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	GV.RM-01 GV.RM-02 GV.RM-03 GV.RM-06	Risk management objectives are established and agreed to by organizational stakeholders; Risk appetite and risk tolerance statements are established, communicated, and maintained…	Editorial	Same topic: Risk Management (editorial pick)
ISO 27001	Clause 6.1.1 Clause 6.1.3	General; Information security risk treatment	Editorial	Same topic: Risk Management (editorial pick) 2 loosely related (not mappings) A.5.1 Policies for information security Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06: related, not a mapping Clause 6.1.2 Information security risk assessment Loosely related Only shares CSF GV.RM-01, GV.RM-02, GV.RM-06: related, not a mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	CC3.1 CC5.1 CC9.1	Objectives specified clearly enough to identify risks; Control activities that mitigate risks…	Editorial	Same topic: Risk Management (editorial pick)
PCI DSS	12.3.1	Targeted risk analysis for flexible-frequency requirements	Editorial	Same topic: Risk Management (editorial pick) 19 loosely related (not mappings) 5.2.3.1 Re-evaluation frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 5.3.2.1 Scan frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 6.3.1 Vulnerabilities identified and risk-ranked Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 6.3.3 Security patches installed promptly Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 8.6.3 System account passwords protected and changed Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 9.5.1.2.1 Inspection frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping 10.4.2.1 Review frequency set by targeted risk analysis Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping …and 11 more in the downloads
CMMC	RA.L2-3.11.1	Risk Assessments	Editorial	Same topic: Risk Management (editorial pick)
800-53	PM-9 PM-28 RA-7	Risk Management Strategy; Risk Framing…	Editorial	Same topic: Risk Management (editorial pick) 6 loosely related (not mappings) PM-30 Supply Chain Risk Management Strategy Loosely related Only shares CSF GV.RM-03, GV.RM-06: related, not a mapping SR-2 Supply Chain Risk Management Plan Loosely related Only shares CSF GV.RM-01, GV.RM-03: related, not a mapping PM-3 Information Security and Privacy Resources Loosely related Only shares CSF GV.RM-03: related, not a mapping PM-18 Privacy Program Plan Loosely related Only shares CSF GV.RM-06: related, not a mapping RA-3 Risk Assessment Loosely related Only shares CSF GV.RM-06: related, not a mapping SA-24 Design For Cyber Resiliency Loosely related Only shares CSF GV.RM-03: related, not a mapping
HIPAA	§164.308(a)(1)(ii)(B)	Risk Management	Editorial	Same topic: Risk Management (editorial pick) 2 loosely related (not mappings) §164.308(a)(1)(ii)(A) Risk Analysis Loosely related Only shares CSF GV.RM-06: related, not a mapping §164.316(a) Policies and Procedures Loosely related Only shares CSF GV.RM-06: related, not a mapping
GDPR	Art.24(1)Art.32(2)	Responsibility of the controller; Security of processing	Editorial	Same topic: Risk Management (editorial pick)
NIS2	2.1 7.1	Risk management framework; Policies and procedures to assess the effectiveness of cybersecurity risk-management measures	Editorial	Same topic: Risk Management (editorial pick) 1 loosely related (not mappings) 1.1 Policy on the security of network and information systems Loosely related Only shares CSF GV.RM-03: related, not a mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(2)(a)Art.6(1)Art.6(8)Art.16(1)Art.24(1)	Governance and organisation; ICT risk management framework…	Editorial	Same topic: Risk Management (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.