Overview
The CPG 234 - Information Security guideline was issued by the Australian Prudential Regulation Authority (APRA) to assist financial institutions and other APRA-regulated entities in maintaining effective information security standards. It outlines expectations for risk management, incident response planning, governance, and third-party management. A key focus is placed on protecting sensitive information assets from internal and external threats, considering both current and emerging risks. Additionally, the document provides entities with principles to integrate into their existing risk management frameworks. CPG 234 aligns with broader obligations under operational risk standards, emphasizing proactive and timely addressing of information security threats.