CPS 234 · Internal audit
Para 32
Internal audit reviews control design and effectiveness
frameworkAPRA CPS 234 Information Security
sectionInternal audit
csf 2.0GV.OC-03 GV.OV-03
topicsCompliance
frameworks0 10 3
Official textAn APRA-regulated entity's internal audit activities must include a review of the design and operating effectiveness of information security controls, including those maintained by related parties and third parties (information security control assurance).APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | GV.OC-03GV.OV-03 | Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed; Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed | Editorial | Same topic: Compliance (editorial pick) |
| ISO 27001 | A.5.31A.5.36Clause 9.1 | Legal, statutory, regulatory and contractual requirements; Compliance with policies, rules and standards for information security… | Editorial | Same topic: Compliance (editorial pick)7 loosely related (not mappings)A.5.20 Addressing information security within supplier agreements Only shares CSF GV.OC-03, GV.OV-03: related, not a mapping A.5.19 Information security in supplier relationships Only shares CSF GV.OV-03: related, not a mapping A.8.34 Protection of information systems during audit testing Only shares CSF GV.OV-03: related, not a mapping Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-03: related, not a mapping |
| CIS v8.1 | — | No requirement | No mapping in our data | No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards). |
| SOC 2 | CC4.1CC4.2 | Ongoing and/or separate evaluations of controls; Communicating and remediating control deficiencies | Editorial | Same topic: Compliance (editorial pick) |
| PCI DSS | 12.4.2 | Service providers: quarterly reviews of operational tasks | Editorial | Same topic: Compliance (editorial pick)16 loosely related (not mappings)3.2.1 Account data storage minimised, with retention and disposal Only shares CSF GV.OC-03: related, not a mapping 7.2.5.1 System and application account access periodically reviewed Only shares CSF GV.OV-03: related, not a mapping 9.4.6 Hard-copy media destroyed when no longer needed Only shares CSF GV.OC-03: related, not a mapping 9.4.7 Electronic media destroyed or made unrecoverable Only shares CSF GV.OC-03: related, not a mapping 10.7.2 Critical security control failures detected and reported Only shares CSF GV.OV-03: related, not a mapping 11.3.1 Internal vulnerability scans every three months Only shares CSF GV.OV-03: related, not a mapping 11.4.4 Penetration test findings corrected and retested Only shares CSF GV.OV-03: related, not a mapping …and 8 more in the downloads |
| CMMC | CA.L2-3.12.1 | Security Control Assessment | Editorial | Same topic: Compliance (editorial pick)1 loosely related (not mappings) |
| 800-53 | CA-2PM-4PM-6 | Control Assessments; Plan of Action and Milestones Process… | Editorial | Same topic: Compliance (editorial pick) |
| HIPAA | §164.308(a)(8) | Evaluation | Editorial | Same topic: Compliance (editorial pick)22 loosely related (not mappings)§164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF GV.OC-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF GV.OC-03: related, not a mapping §164.308(a)(4)(ii)(C) Access Establishment and Modification Only shares CSF GV.OC-03: related, not a mapping …and 14 more in the downloads |
| GDPR | Art.5(2) | Principles relating to processing of personal data | Editorial | Same topic: Compliance (editorial pick) |
| NIS2 | 2.22.3 | Compliance monitoring; Independent review of information and network security | Editorial | Same topic: Compliance (editorial pick) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(f)Art.6(6)Art.6(7) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Compliance (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.