Home / Rules / APRA CPS 234 Information Security / APRA CPS 234 para 35 (notify APRA within 72 hours)
APRA CPS 234 para 35 (notify APRA within 72 hours)
The entity must tell APRA promptly, and at the latest within 72 hours of becoming aware, of any information security incident that either (a) had, or could have had, a material financial or non-financial effect on the entity itself or on the interests of its depositors, policyholders, beneficiaries or other customers (the impact limb), or (b) has already been notified to another regulator in Australia or overseas. A footnote covers incidents not already reported under CPS 231, SPS 231, CPS 232 or SPS 232, and counts domestic government agencies and international regulators as other regulators.
Steps that cite it
Evidence commonly asked for
- Notification procedure stating the 72-hour clock, who decides materiality and who submits to APRA
- Materiality assessment criteria and completed assessments per incident
- Copies of APRA notifications with timestamps of awareness and submission
- Register of notifications to other regulators that triggers APRA notification
Accepted citation forms are listed on the answer format page.