CPS 234 · APRA notification
Para 36
Notify APRA of material control weaknesses within 10 business days
frameworkAPRA CPS 234 Information Security
sectionAPRA notification
csf 2.0RS.CO-02
topicsReporting
frameworks0 12 1
Official textAn APRA-regulated entity must notify APRA as soon as possible and, in any case, no later than 10 business days, after it becomes aware of a material information security control weakness which the entity expects it will not be able to remediate in a timely manner.APRA Prudential Standard CPS 234 Information Security. Based on content from the Federal Register of Legislation at 27 October 2026 (footnote markers removed and lines reflowed). For the latest information on Australian Government legislation please go to https://www.legislation.gov.au. Licensed under CC BY 4.0: https://creativecommons.org/licenses/by/4.0/
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | RS.CO-02 | Internal and external stakeholders are notified of incidents | Editorial | Same topic: Reporting (editorial pick) |
| ISO 27001 | A.5.5A.6.8 | Contact with authorities; Information security event reporting | Editorial | Same topic: Reporting (editorial pick)2 loosely related (not mappings) |
| CIS v8.1 | CIS 17.3 | Establish and Maintain an Enterprise Process for Reporting Incidents | Editorial | Same topic: Reporting (editorial pick)1 loosely related (not mappings)CIS 17.2 Establish and Maintain Contact Information for Reporting Security Incidents Only shares CSF RS.CO-02: related, not a mapping |
| SOC 2 | CC2.3 | Communication with external parties | Editorial | Same topic: Reporting (editorial pick) |
| PCI DSS | 12.10.1 | Incident response plan ready to activate | Editorial | Same topic: Reporting (editorial pick) |
| CMMC | IR.L2-3.6.2 | Incident Reporting | Editorial | Same topic: Reporting (editorial pick)1 loosely related (not mappings) |
| 800-53 | IR-6 | Incident Reporting | Editorial | Same topic: Reporting (editorial pick)4 loosely related (not mappings) |
| HIPAA | §164.308(a)(6)(ii) | Response and Reporting | Editorial | Same topic: Reporting (editorial pick)5 loosely related (not mappings)§164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF RS.CO-02: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF RS.CO-02: related, not a mapping §164.314(b)(2)(iv) Group Health Plan Implementation Specification Only shares CSF RS.CO-02: related, not a mapping |
| GDPR | Art.33(1)Art.34(1) | Notification of a personal data breach to the supervisory authority; Communication of a personal data breach to the data subject | Editorial | Same topic: Reporting (editorial pick) |
| NIS2 | 3.3 | Event reporting | Editorial | Same topic: Reporting (editorial pick) |
| Essential Eight | ISM-0123ISM-0140 | Cyber security incidents are reported to the chief information security officer, or one…; Cyber security incidents are reported to ASD as soon as possible after they occur or… | Editorial | Same topic: Reporting (editorial pick) |
| DORA | Art.18(1)Art.19(1)Art.19(3)Art.19(4) | Classification of ICT-related incidents and cyber threats; Reporting of major ICT-related incidents and voluntary notification of significant cyber threats… | Editorial | Same topic: Reporting (editorial pick) |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.