Strengthening Security Metrics with APRA’s Assessment
The regulated entities were required to collaborate with an independent auditors appointed by APRA to verify their compliance to the Prudential Standard CPS 234 Information Security. As an essential part of the process, breach reporting and the subsequent strengthening of oversight were initiated when vulnerabilities were discovered.
The initial findings pertain to about one-fourth of APRA’s regulated entities, providing an overview of security gaps that need immediate attention.
Unravelling the Security Gaps
Among the array of challenges that surfaced during the assessment, six core areas were identified that displayed major lapses:
- Insufficient identification and categorization of vital and confidential information assets;
- Underestimated scrutiny of third-party information security competencies;
- Poorly defined and implemented control testing initiatives;
- Infrequently reviewed or tested incident response tactics;
- Meagre internal audits of information security barriers; and,
- Tardy and inconsistent reporting of substantial incidents and control failures to APRA.
Currently, entities are engaged with the follow-up phases of APRA's evaluations, with the final assessment round due for a 2023 rollout.
Lessons from the Superannuation CEO Roundtable
The recent Superannuation CEO Roundtable served as a forum for APRA and ASIC to discuss the identified gaps. Understanding these gaps and implementing a planned strategy is crucial to prevent substantial compromise.
Several vital takeaways from this roundtable discussion include:
- Consistent governance measures in data and IT systems, including decommissioning legacy systems and ensuring thorough service provider oversight.
- Planning and testing incident response plans, including leadership and decision-making, business continuity planning, and communication strategies are of utmost importance to be prepared in case of an incident.
- Cyber threat simulations and the consequent responses by the trustees can significantly enhance their preparedness. A clear division between the roles of board and management can help in handling any potential threat.
- Cyber events can detrimentally affect members. The trustees are responsible for making decisions in favor of their members. This includes the provision of timely and accurate communication and ensuring adequate resources for appropriate member support.
Therefore, the APRA findings highlight the urgent need to bolster cyber-security measures in the financial services sector. Investing in robust information security measures, such as improved internal audits, responsible third-party management, and stringent incident response strategies, remains critical.
