Australian Prudential Regulation Authority (APRA)
A fourth 72-hour clock, for regulated entities, on a materiality test of its own.
Responsibilities
- Administer Prudential Standard CPS 234 Information Security
- Receive notification of material information security incidents within 72 hours
Prudential Standard CPS 234 requires an APRA-regulated entity to notify APRA as soon as possible and no later than 72 hours after becoming aware of an information security incident that materially affected, or had the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers.
For a regulated entity that is also a critical infrastructure responsible entity and also holds personal information — which describes most large Australian banks and insurers — a single intrusion can produce a 12-hour report to ASD, a 72-hour report to ASD, a 72-hour report to APRA, a 72-hour ransomware payment report if a payment is made, and a Privacy Act assessment and notification to the OAIC and to affected individuals.
Five reports, four bodies, four clocks, one incident.
Where this body appears in a process
Every point at which Australian Prudential Regulation Authority can hold something up, and why.
| Process | Step | Why it waits | Clock | Typical |
|---|---|---|---|---|
| An entity reports one cyber incident | APRA material incident notification notification | statutory | 3 | 3 |