Home / Rules / APRA CPS 230 Operational Risk Management / APRA CPS 230 para 32 (operational risk incident notification)
APRA CPS 230 para 32 (operational risk incident notification)
Clock: as soon as possible, and at the latest 72 hours from the time the entity becomes aware. Trigger: an operational risk incident the entity has determined is likely to cause a material financial impact, or to materially affect its ability to keep its critical operations running. An information security incident already notified to APRA under CPS 234 need not be notified again under this paragraph.
Steps that cite it
- KC-05 S2 CPS 230 para 32: a second incident notification?
Evidence commonly asked for
- APRA notification procedure stating the 72-hour clock, the materiality determination and the decision owner
- Incident log fields recording awareness time, materiality determination time and APRA notification time
- Copies of notifications lodged with APRA and acknowledgements
- Record of the CPS 234 cross-check where an incident was notified under CPS 234 instead
Accepted citation forms are listed on the answer format page.