CPS 234 · Internal audit
Para 34
Internal audit assesses third-party assurance relied on
frameworkAPRA CPS 234 Information Security
sectionInternal audit
csf 2.0DE.CM-06 GV.OC-03 GV.OV-03 GV.SC-04 GV.SC-06 GV.SC-07 ID.RA-10
topicsCompliance, Vendor Risk Mgmt
frameworks0 11 2
Official textAn APRA-regulated entity's internal audit function must assess the information security control assurance provided by a related party or third party where:
(a) an information security incident affecting the information assets has the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; and
(b) internal audit intends to rely on the information security control assurance provided by the related party or third party.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
(a) an information security incident affecting the information assets has the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; and
(b) internal audit intends to rely on the information security control assurance provided by the related party or third party.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | DE.CM-06GV.OC-03GV.OV-03GV.SC-04GV.SC-06GV.SC-07ID.RA-10 | External service provider activities and services are monitored to find potentially adverse events; Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed… | Editorial | Same topic: Vendor Risk Mgmt, Compliance (editorial pick) |
| ISO 27001 | A.5.19A.5.20A.5.22A.5.31A.5.36Clause 9.1 | Information security in supplier relationships; Addressing information security within supplier agreements… | Editorial | Same topic: Vendor Risk Mgmt, Compliance (editorial pick)9 loosely related (not mappings)Clause 4.2 Understanding the needs and expectations of interested parties Only shares CSF GV.OC-03, GV.SC-06: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping Clause 6.1.3 Information security risk treatment Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping …and 1 more in the downloads |
| CIS v8.1 | CIS 15.1CIS 15.3CIS 15.4CIS 15.5CIS 15.6CIS 15.7 | Establish and Maintain an Inventory of Service Providers; Classify Service Providers… | Editorial | Same topic: Vendor Risk Mgmt (editorial pick)1 loosely related (not mappings)CIS 15.2 Establish and Maintain a Service Provider Management Policy Only shares CSF DE.CM-06: related, not a mapping |
| SOC 2 | CC4.1CC4.2CC9.2 | Ongoing and/or separate evaluations of controls; Communicating and remediating control deficiencies… | Editorial | Same topic: Compliance, Vendor Risk Mgmt (editorial pick) |
| PCI DSS | 12.4.212.8.112.8.212.8.312.8.412.8.5 | Service providers: quarterly reviews of operational tasks; List of third-party service providers kept… | Editorial | Same topic: Compliance, Vendor Risk Mgmt (editorial pick)21 loosely related (not mappings)1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 12.5.2 PCI DSS scope confirmed annually and on change Only shares CSF GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping 6.3.2 Inventory of custom software and its components Only shares CSF GV.SC-04, GV.SC-07: related, not a mapping 12.9.1 Service providers acknowledge responsibilities to customers Only shares CSF GV.OC-03, GV.SC-07: related, not a mapping 12.9.2 Service providers support customer compliance requests Only shares CSF GV.OC-03, GV.SC-07: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Only shares CSF GV.OC-03: related, not a mapping …and 13 more in the downloads |
| CMMC | CA.L2-3.12.1 | Security Control Assessment | Editorial | Same topic: Compliance (editorial pick)5 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF GV.OV-03, GV.SC-04, GV.SC-06, GV.SC-07…: related, not a mapping |
| 800-53 | CA-2PM-4PM-6SA-4SA-9SR-6 | Control Assessments; Plan of Action and Milestones Process… | Editorial | Same topic: Compliance, Vendor Risk Mgmt (editorial pick)8 loosely related (not mappings) |
| HIPAA | §164.308(a)(8)§164.308(b)(1)§164.314(a) | Evaluation; Business Associate Contracts and Other Arrangements… | Editorial | Same topic: Compliance, Vendor Risk Mgmt (editorial pick)28 loosely related (not mappings)§164.308(b)(4) Written Contract or Other Arrangement Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(ii) Other Arrangements Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.314(b)(2)(iii) Group Health Plan Implementation Specification Only shares CSF DE.CM-06, GV.SC-04, GV.SC-06, GV.SC-07: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Only shares CSF DE.CM-06, GV.OC-03: related, not a mapping §164.308(a)(3)(ii)(B) Workforce Clearance Procedure Only shares CSF DE.CM-06, GV.OC-03: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Only shares CSF DE.CM-06, GV.OC-03: related, not a mapping …and 20 more in the downloads |
| GDPR | Art.5(2)Art.28(1)Art.28(3) | Principles relating to processing of personal data; Processor… | Editorial | Same topic: Compliance, Vendor Risk Mgmt (editorial pick) |
| NIS2 | 2.22.35.15.26.1 | Compliance monitoring; Independent review of information and network security… | Editorial | Same topic: Compliance, Vendor Risk Mgmt (editorial pick) |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(2)(f)Art.6(6)Art.6(7)Art.28(3)Art.28(4)Art.28(5)Art.28(8)Art.30(2)Art.30(3) | Governance and organisation; ICT risk management framework… | Editorial | Same topic: Compliance, Vendor Risk Mgmt (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.