💼 73 Under CPS 234, an APRA-regulated entity’s information security response plans must include mechanisms for managing all relevant stages of an incident.

Contextual name: 💼 73 Under CPS 234, an APRA-regulated entity’s information security response plans must include mechanisms for managing all relevant stages of an incident.
ID: /frameworks/apra-cpg-234/27/73
Located in: 💼 27 Incident management - Information security incident stages

Description

Empty...

Section	Internal Rules	Policies
💼 73a detection of an information security event through the use of automated sensors and manual review;	9	9
💼 73b identification and analysis to determine if it is an incident or an event;	9	9
💼 73c escalation to ensure that decision-makers are aware of the incident and to trigger incident response processes;	2	2
💼 73d containment to minimise the damage caused, and reduce the possibility of further damage;	9	9
💼 73e eradication which involves the removal of the source of the information security compromise (typically malware);	9	9
💼 73f response and recovery which involves a mixture of system restoration (where integrity and availability have been compromised) and managing sensitive data loss where confidentiality has been compromised. This allows for a return to businessas-usual processing;	4	4
💼 73g post-incident analysis and review to reduce the possibility of a similar information security incident in the future, improve incident management procedures and forensic analysis to facilitate attribution and restitution (where relevant).