| 💼 73 Under CPS 234, an APRA-regulated entity’s information security response plans must include mechanisms for managing all relevant stages of an incident. | 7 | | | |
| 💼 73a detection of an information security event through the use of automated sensors and manual review; | | 9 | 9 | |
| 💼 73b identification and analysis to determine if it is an incident or an event; | | 9 | 9 | |
| 💼 73c escalation to ensure that decision-makers are aware of the incident and to trigger incident response processes; | | 2 | 2 | |
| 💼 73d containment to minimise the damage caused, and reduce the possibility of further damage; | | 9 | 9 | |
| 💼 73e eradication which involves the removal of the source of the information security compromise (typically malware); | | 9 | 9 | |
| 💼 73f response and recovery which involves a mixture of system restoration (where integrity and availability have been compromised) and managing sensitive data loss where confidentiality has been compromised. This allows for a return to businessas-usual processing; | | 4 | 4 | |
| 💼 73g post-incident analysis and review to reduce the possibility of a similar information security incident in the future, improve incident management procedures and forensic analysis to facilitate attribution and restitution (where relevant). | | | | |