APRA CPS 234 - Summary of Security Compliance Requirements

In my work with NTT, I've recently been dealing with several FSI-based (Financial Services Industry) organisations who have to comply with the Australian Prudential Regulation Authority (APRA) Standard CPS 234 July 2019. Here's a brief overview of what that compliance with CPS 234 entails:

1. APRA CPS 234 is Cybersecurity 101 for Banks, Insurers and related institutions.
2. As with standards like ISO27001:2013, it is a risk-based approach about ensuring that adequate CIA (Confidentiality, Integrity and Availability) is maintained for information assets.
3. The Board is ultimately responsible for ensuring appropriately robust policies and controls are in place for both the organisation and 3rd party contractors.
4. Per basic concepts in CISSP (Certified Information Systems Security Professional), controls should really only be implemented if the cost of control implementation is less than the costs of the data being lost/breached.
5. To this effect - the information security capability basically has to pass the "reasonableness" test
1. The security capability should match the size and extent of threats
2. The controls should match criticality and sensitivity of the assets
6. CPS 234 aims to ensure that an APRA-regulated entity takes measures to be resilient against information security incidents (including cyberattacks) by maintaining an information security capability commensurate with information security vulnerabilities and threats:
• Know your responsibilities (The board is ultimately responsible).
• Know what you have and protect it appropriately. An APRA-regulated entity must classify its information assets, including those managed by related parties and third parties, by criticality and sensitivity.
• Ideally - should be using Azure Info protection or similar to provide security labels (e.g. classification, sensitivity or dissemination limiting markers) to drive preventative and detective controls. 
• Detect and React appropriately:
• Have Incident Plans and RACIs (Responsible, Accountable, Consult, Inform) in terms of response
• Appropriately skilled people to detect incidents. This requires user awareness and security practices.
• Notification of breach within 72 hours.
• Implies that proper threat detection (pro-active) and monitoring systems should be in place. If you don't know it's happening then you can't comply.
• Test and Audit Regularly. Must test effectiveness of controls with a systematic testing program - that is run at least annually.
• This lends itself to regular, automated (static/dynamic) testing.

It is always critical to keep in mind that threats come from both threat actors inside (insider threat) and outside the organisation (organised or individual actors) - which lends itself to zero trust approaches to cybersecurity.