| 💼 21 An APRA-regulated entity’s information security policy framework is commonly structured as a hierarchy, with higher level policies supported by underlying standards, guidelines and procedures. A policy framework would normally be informed by a set of information security principles that guide decision-making with regard to information security (refer to Attachment A for common information security principles). | 11 | | | |
| 💼 21a identification, authorisation and granting of access to information assets (refer to Attachment C for further guidance); | | | | |
| 💼 21b life-cycle1 management that addresses the various stages of an information asset’s life to ensure that information security requirements are considered at each stage, from planning and acquisition through to decommissioning and destruction; | | | | |
| 💼 21c management of information security technology solutions that include firewall, antimalicious software, intrusion detection/prevention, cryptographic systems and monitoring/log analysis tools; | | | | |
| 💼 21d definition of an overarching information security architecture that outlines the approach for designing the IT environment (encompassing all information assets) from a security perspective (e.g. network zones/segments, end point controls, gateway design, authentication, identity management, interface controls, software engineering and location of information security technology solutions and controls); | | | | |
| 💼 21e monitoring and incident management to address the identification and classification of incidents, reporting and escalation guidelines, preservation of evidence and the investigation process; | | | | |
| 💼 21f expectations with respect to the maintenance of information security when using third parties and related parties; | | | | |
| 💼 21g acceptable usage of information assets that define the information security responsibilities of end-users including staff, third parties, related parties and customers (refer to Attachment B and Attachment F for further guidance); | | | | |
| 💼 21h recruitment and vetting of staff and contractors; | | | | |
| 💼 21i information security roles and responsibilities; | | | | |
| 💼 21j physical and environmental controls; | | | | |
| 💼 21k mechanisms to assess compliance with, and the ongoing effectiveness of, the information security policy framework. | | | | |
| 💼 22 An APRA-regulated entity’s information security policy framework would typically be consistent with other entity frameworks such as risk management, service provider management and project management. | | | | |