I-CPS 234 ifumaneka ngalinye iingxaki ze-infrastructure ye-security ye-entity, ngoko ukuvelisa kunokwenzeka ngaphandle kokufunda. Ukuze ufumane indawo yokuqala, le nqaku uya kubandakanya: 
 
 
 
 Umgangatho kunye nenkqubo ye-CPS 234 Umbala we-Framework Izinyathelo zokusebenza zokusebenza Yintoni i-CPS 234? I-CPS 234 yi-standard ye-prudential eyenziwe ngu-APRA enikezela iimfuno ze-cyber resilience kwi-entities ezihlawulweyo. I-CPS 234 ifumaneka ngo-2019 njenge-reaction ye-Autority kwi-number kunye ne-sofistication yeengxaki ze-cyber security. Iinkonzo ze-finance kunye ne-insurance ziquka kakhulu kumaziko efanayo, ngoko i-APRA ibonise iimfuno ezininzi nge-CPS 234 yokusiza ukwandisa iziphumo zayo. kunye nokunciphisa iingxaki ezahlukeneyo, ikakhulukazi: Ukhuseleko 
 
 
 
 Iingxaki ze-Security ze-External Ukukhangisa kunye nokukhangisa idatha sensitive Ukucaciswa kwezobugcisa ezidlulileyo ngenxa ye-negligence yeqela zangaphakathi Yintoni i-CPS 234 ifumaneka kwiimveliso ezininzi zeCPS? I-CPS 234 yi-standard eyahlukileyo eyongezelela i-CPS 230, ebandakanya i-risk ye-operational, kuquka i-technology risk. I-CPS 230 ifumaneka ngoJulayi 1 2025, kwaye i-CPS 231 (Outsourcing), i-SPS 231 (Outsourcing), i-HPS 231 (Outsourcing), i-CPS 232 (Business Continuity Management), kunye ne-SPS 232 (Business Continuity Management). Yintoni kufuneka uqhagamshelane neCPS 234? I-CPS 234 ibonisa iindidi ezincinane zeentlawulo ezidlulileyo ziye kufuneka ziyafikelele kwi-standard: 
 
 
 
 
 
 I-Authorised Deposit-taking Institutions (i-ADIs) I-General Insurers Iinkampani Life I-Private Health Insurers Registered Under the Private Health Insurance (Prudential Supervision) PHIPS Act I-Registrable Superannuation Entities (RSE), i-Licency Under the Superannuation Industry (Supervision) SIS Act ‍ Ukusetyenziswa kwakhona ngokucacileyo, nto leyo yenza kulula ukufumana njani i-CPS 234 ikhawuleza inkqubela lakho kwaye uyifumana zonke iimfuneko ezininzi. Ukuba usebenzise kunye ukuba unako ukufumana idatha sensitive kwi-scope, iimfuno ye-framework ibandakanya bonke kubo, kubandakanya iinkonzo ngaphandle kwe-Australia. Iimpawu ze-3 Yintoni i-CPS 234 ifumaneka kumazwe omnye kunye nabathengisi ngamazwe Iintliziyo ze-Third-Parts, kuquka iintliziyo ze-Australia, ayikho ngqo kwi-CPS 234, kodwa kunokwenzeka ukuba zihlanganise ukusebenza kwe-control efanelekileyo efanelekileyo kwi-CPS 234, efunyenwe yi-APRA-regulated entity ebonakalayo. Umzekelo kwezinye izakhiwo zihlanganisa: 
 
 
 
 I-fintech e-USA ibonelela i-cloud-based loan platform yeebhanki e-Australia I-US-based data analytics provider isebenza iinkcukacha ze-superannuation Umthengisi we-cybersecurity usihlanganisa i-infrastructure ye-Australian insurers ukusuka emzimbeni Kwiimeko ezidlulileyo (kwiimeko ezininzi ezinxulumene ukugcina idatha ye-foreign), iinkonzo kufuneka zibonise kunye nokuvelisa iinkonzo ezininzi ezihambelana ne-CPS 234. Ukwenza oku kunokwenzeka ngempumelelo kakhulu kwiinkalo eziholise iCLOUD (Clarifying Legal Overseas Use of Data) Act. Nangona kungenxa ngokuthe ngqo i-CPS 234, kunokukhathaza i-conflict ephakamileyo kumazwe e-Australia usebenzisa iinkonzo ze-cloud kwiinkonzo ze-US-based. I-CLOUD Act ivumela iinkqubo ze-U.S. ukufikelela iinkcukacha ze-US-based providers, nangona iinkcukacha zithunyelwe kwimveliso. Njengoko ke, iinkonzo ze-Australian ezisebenzisa iinkonzo ze-CPS 234 zihlanganisa ukuba iimfuno ze-confidentiality kunye ne-sovereignty ziyafumaneka. Oku kubandakanya ukuxhaswa okucacileyo phakathi kwe-CPS 234 kunye ne-CLOUD Act. Ngenxa yokuba unemibuzo emininzi malunga neengxaki ze-security yeentlobo ze-third-party, njenge-entity ebhalisiweyo kufuneka ukulawule ukuxhaswa kwe-CPS 234 ngeengxaki ze-legal kunye neengxaki ze-contracts ezizibelelana nokusetyenziswa kwe-standard. Ukucacisa zonke iimeko ezininzi, ucebisa iintlobo zebhizinisi ufumane nomthengisi. Kule ngoko kufuneka ukhawuleze umphumela we-incident ebonakalayo kwinkqubo yakho okanye iimveliso zokusebenza ukuze ufunde ubunzima we-risk yaye umthengisi. CPS 234 ukulawula I-CPS 234 ibonise iindawo ezine zokusetyenziswa kwamandla, zonke ziye zihlanganisa iinkcukacha ze-control ezisetyenziswa kwiziko zokusetyenziswa kwiinkalo zokusetyenziswa kwi-risk environment: 
 
 
 
 
 
 
 
 
 
 Iimpawu kunye neengxaki Umthamo we-Information Security Iinkqubo zePolicy Ukucaciswa kunye nokuhlanganiswa kwimali yobugcisa Ukusetyenziswa kwe-Information Security Controls Ukulawula Incident Ukubonisa ukusebenza kwe-Control I-audit ye-internal emva kokufumana ‍ Iimfuno zibonakalayo kunye nezicelo, kwaye zenzelwe ukufumana iimfuno eziphambili ze-framework: 
 
 
 
 
 Ukucacisa ngokucacileyo iingxaki kunye neengxaki ezinxulumene ne-security Ukuphathwa kwizinga lwezobugcisa lwezobugcisa lwezobugcisa lwezobugcisa lwezobugcisa lwezobugcisa lwezobugcisa lwezobugcisa Ukusebenza iinkqubo ezifanelekileyo zokhuseleko i-information assets ye-organisation Ukubonisa APRA iingxaki zokhuseleko ezinxulumene ‍ Ukongezelela kwe-clarity, ingxaki elikhulu ye-CPS 234 kuyinto ukuxhaswa kwayo Ukuba ungenza ngokupheleleyo ISO 27001, kufuneka ukufumana ukufikelela kwe-CPS 234 ngempumelelo nge-control mapping efanelekileyo. ISO 27001 ukulawula ‍ I-CPS 234 Iingxelo zokusebenza Ngokusho ukwandiswa kwe-APRA kwimveliso ye-cyber resilience, ama-entities ezihlawulwe kufuneka bakwazi ukuxhaswa kwimfuneko ye-CPS 234 kunye nokulawula okuqhubekayo. Ukuphazamiseka kwe-cash ye-non-compliance ayikho ngokucacileyo kwi-CPS 234 ngokulinganayo. Ngoku, i-cash ziquka kwi-akhawunti ezininzi ezinxulumene ne-entity, njenge-Banking Act, Insurance Act, Life Insurance Act, kunye ne-Superannuation Industry (Supervision) Act. Ngokusho ne-entity ye-regulated, i-cash iya kuquka iinkonzo, i-direction, okanye, kwimeko ezininzi, i-procedure ye-civil okanye ye-criminal. Inkampani yakho ingangena kwimeko ezininzi ezifana: 
 
 
 
 I-escalation yeMthetho Ukuphazamiseka kwimveliso Ukuphazamiseka ‍ Iingxaki ze-7 ukuya ku-CPS 234 Compliance Nangona i-applicability i-category ye-organization yakho, unako ukufumana ukuxhaswa kwe-CPS 234 kunye nokulawula ingozi yakho yebhizinisi ngokusebenzisa iindlela ezilandelayo: 
 
 
 
 
 
 
 
 Ukubonisa iingxowa kunye neengxowa Ukuvelisa nokufumana amandla ukhuseleko Information Ukubonisa isakhiwo sePolicy epheleleyo Ukucinga kunye nokuhlanganisa i-information assets Ukuqhagamshelwano okuqinile Ukulungiselela iinkqubo zokulawula iingxaki Yenza i-internal audits ezivamile ‍ Iingxaki ezilandelayo ziquka zonke iingxaki kunye neengxaki ezininzi zonyango. Isisombululo 1: Ukubonisa iingxaki kunye neengxaki I-CPS 234 i-Section 13 ibandakanya iingxaki kunye neengxaki ze-Board, i-Senior Management, i-IT staff, kunye nabanye abasebenzi ezinxulumeneyo. Nangona kunjalo, ingcindezi yokuqala ibandakanya i-Board, ebandayo ekugqibeleni i-information security ye-organisation. Yintoni ke kubalulekile ukufumana i-buy-in yeeyunivesithi ephezulu ngaphambi kokuphuhlisa i-CPS 234 yokusebenza i-strategy. Baya kufuneka bayifumana iingxaki zayo kunye neengxaki zeengxaki. Ngokutsho kwe-Section 13, i-Board kufuneka isebenze kunye nokuthintela iinkonzo zokhuseleko ezinxulumene neengxaki zokhuseleko ye-Information. Oku kubandakanya ukuba kuqala ukufumana indawo yakho yokhuseleko ngokufanisa iingxaki zokhuseleko kunye ne-Risk Assessments. Ukucaciswa Ukusetyenziswa kwinkqubo, unako ukuvelisa iinkombiso ezizodwa ezifana ne-Information Security Steering Committee kunye ne-Risk Management Committee. Zifumaneka ukuvelisa iingcebiso ezininzi kunye nokuncedisa i-Board malunga neengcebiso ezidlulileyo ezisetyenziswa. Isinyathelo 2: Uphuhliso kunye nokugcina amandla ukhuseleko Information Emva kokufumana i-risk profile kunye ne-security landscape yabasetyhini yakho, uthathe i-assessment epheleleyo yeengxaki ze-security ezikhoyo ukuze zibonise iingxaki ze-compliance. I-CPS 234 inikezela iinkonzo ukuvelisa le nkqubo kumazwe ngamazwe omnye ekulawuleni iimveliso ze-information, kuquka: 
 
 
 
 Umthengisi we-Cloud Iinkcukacha zePayment Processors I-SaaS Platforms kunye ne-access to sensitive data ‍ Emva kokufanisa izibuyekezo ezininzi, usebenzisa iziphumo ukuvelisa kunye nokulawula amandla kwiindawo ezifana: 
 
 
 
 
 Ukusabela kunye nokulawula iintloko Ukucaciswa kwimeko Ukucaciswa Ukusabela Ukusabela ‍ Isisombululo 3: Ukwakha isakhiwo esisombululo I-CPS 234 inikezela iinkonzo ukuvelisa kunye nokugcinwa inkcazelo yokhuseleko lwezobugcisa ezinxulumene neengxaki ezinxulumene kunye neengxaki zokusetyenziswa kwimvelo yayo. Njengoko iinkonzo zokhuseleko, inkcazelo lwezobugcisa (i-Section 18) kufuneka ifanelekileyo kunye neengxaki zokusetyenziswa kwezobugcisa kunye neengxaki zayo kwi-operational stability ye-organisation. ‍ I-Policy kuquka zonke iintlawulo kunye neentlawulo zokhuseleko ezinxulumene, njenge: 
 
 
 
 
 Ukulawula ukufikelela I-Hardware kunye ne-Software Protection Ukulawula Configuration Umgangatho weRisk ye-Third Party ‍ Njengoko ukhuseleko lwekhompyutha yakho kubandakanya ngokugqithisileyo, izixhobo zakho ze-CPS 234 ziyafumaneka ukuba ziyafumaneka ngokugqithisileyo. Kwiimeko, uqhagamshelane ngexabiso kunye ne-evaluations ze-threat landscape yokuqinisekisa iinkqubo zakho ngokufanelekileyo. Ukucaciswa kwebhizinisi kwinkampani kubalulekile ekusebenziswano olusebenzayo, ngoko uqhagamshelane iinkcazelo kubasetyhini ezinxulumene ngamazwe ngamazwe ngamazwe ngamazwe ngamazwe ngamazwe ngamazwe ngamazwe ngamazwe ngamazwe ngamazwe. Kwakhona kufuneka uqhagamshelane iinkcazelo zokusebenza ezifanelekileyo ezibonisa iinkcazelo zebhizinisi kumasetyhini yakho ekusetyenziswa iinkcazelo zebhizinisi kwimisebenzi zokusetyhini. Isinyathelo 4: Ukubonisa kunye nokuhlanganisa iimveliso zeinformatics Ukukhusela ngempumelelo, kufuneka uqhagamshelane kunye nokuhlanganisa ngokuhambisana ne-criticality kunye ne-sensitivity yayo. Oku kufanelekileyo kwi-assets ye-internal kunye ne-assets eyenziwa kumazwe omnye, apho kufuneka uqhagamshelane ngokugqithisileyo ngenxa ye-threat landscape. I-CPS 234 I-Section 20 ibandakanya iinkonzo zokusetyenziswa kwi-classification ye-assets ngokutsho kwimiphumo ye-financial okanye ye-non-financial ye-incident. Le miphumo akhawuntiwe kuphela kwi-organization yenye, kodwa nangaphezulu kwizinto eziphambili, ngokukodwa: 
 
 
 
 
 Ukucaciswa iimveliso Ukufumaneka Iinkampani ezininzi ‍ Njengoko indawo yakho yokhuseleko isibambisane, kufuneka uqhagamshelane kunye nokuqinisekisa iimveliso xa kufuneka. Ukongezelela kwimibelelwano embalwa, nceda uqhagamshelane imibuzo embalwa emva kweemeko ezilandelayo: 
 
 
 
 Iingxaki zokhuseleko ezifakwe Onboarding / offboarding abenzi ezintsha kunye nokufumana izixhobo zokuxhumana Iimveliso ezininzi kwi-IT infrastructure ‍ Isinyathelo 5: Ukusetyenzisa izihlangu ezininzi I-CPS 234 inikeza iinkonzo ukuvelisa kunye nokulawula iinkonzo zokhuseleko ezihambelana: 
 
 
 
 
 Iimpawu kunye neengxaki ze-information asset I-Criticality kunye ne-Sensitivity I-Life Cycle Phase ye-Information Asset Imiphumela ye-potency of a security incident ‍ Nangona iinkqubo zakho zokusebenza, iinkqubo ezilungileyo ziquka ukuvelisa ezi zokusebenza kwiimeko zakho ze-development, i-testing, kunye ne-production ngenxa yokuba ama-threats ziyafumaneka kwimeko ezininzi. Njengoko iinkqubo ze-security ze-third-party ziya kubandakanyeka ngokuthe ngqo kwi-security posture yakho, i-CPS 234 ibanga iinkampani ukuba zibonise. Ukuba unokufumana iingcaciso, unako ukuguqulwa ngexesha le-contract ukuguqula iinkqubo ezithile zokusebenza. Iingcingo zakho ze-security ziquka iinkcukacha kwi-risk profile yakho kunye ne-security landscape, ngoko kuhlolwa ngokuqhelekileyo ukuze ubone ukuba iingcingo ezininzi ziquka. Isinyathelo 6: Ukuvelisa iinkqubo zokulawula iingxaki Ngokutsho i-CPS 23-25 i-CPS 234, iinkqubo ezisebenzayo zokufumana kunye nokuphendula kwimiphumo ze-security. Nangona i-CPS 234 ayifuneka inkqubo eyodwa, iinkqubo ezilungileyo ze-industry – ezifana ne-NIST kunye ne-SANS – zixhomekeke ukuba zihlanganise iinyathelo ezininzi ezilandelayo: 
 
 
 
 
 
 
 Ukucinga Ukucaciswa Ukucinga Ukucaciswa Ukuguqulwa Ukubuyekezwa kwe-post-incident ‍ Iingcebiso zayo ziya kuxhomekeke kwiinkqubo zayo zokusebenza kunye ne-IT infrastructure, kodwa bonke ziya kufunyanwa inkxaso elifanayo-ukuphendula kwiincwadi ngokukhawuleza kunye neengxaki ezincinane. Kwakhona kufuneka uqhagamshelane iinkqubo ezibonakalayo zokukhuthaza kunye nokuthunyelwa kwabasebenzi kwi-Board kunye nezinye iingxaki ezinxulumeneyo. Oku kufuneka ukuba unayo iinkqubo ezisebenzayo zokuthunyelwa kwinxalenye lwezilwanyana kunye neengxaki zibonakalayo zokuthunyelwa. Ukuba i-incidente ifumaneka, kufuneka uqhagamshelane ne-APRA ngaphakathi kweiyure ze-72 kwaye uqhagamshelane neengxaki ze-control eyenza i-incident kwiintsuku ze-10 zokusebenza. Oku kubalulekile ukuba kufuneka inkqubo ye-notification epheleleyo ye-external, ngaphandle kweengxaki ze-communication ezisebenzayo ze-internal. 
 
 
 "Ukuvelisa i-Incident Response Plan, leyo kuquka ukuhlaziywa kwi-APRA, uya kukunceda ukuhlaziywa ngexabiso leyo leyo leyo kunye nomntu kwiqela lakho kufuneka uyenze isithombe lokugqibela. I-Incident Response Plan yinto enomthombo enzima ekusebenziseni i-incident yokhuseleko." U-Evan Rowse I-GRC I-Subject Matter Expert, i-Vanta, i-Linkedin "Ukuvelisa i-Incident Response Plan, leyo kuquka ukuhlaziywa kwi-APRA, uya kukunceda ukuhlaziywa ngexabiso leyo leyo leyo kunye nomntu kwiqela lakho kufuneka uyenze isithombe lokugqibela. I-Incident Response Plan yinto enomthombo enzima ekusebenziseni i-incident yokhuseleko." U-Evan Rowse I-GRC I-Subject Matter Expert, i-Vanta, i-Linkedin I-CPS 234 I-Section 26 ibandakanya iinkonzo ze-incident response izivumelwano zonyaka ngamnye ukuze kubonise ukusebenza okuqhubekayo. Ukongezelela kwizibuyekezo ze-policy ezinxulumeneyo, kufuneka uqhagamshelane i-simulations ukuze kuboniswe ukuba izivumelwano zithembekile kwiimeko ze-real-life. Isisombululo se-Step 7: Qhagamshelana ne-internal audits Kukho inqubo ye-CPS 234 yokufanelekiswa, kwaye i-APRA ayibonisa nayiphi na izitifiketi ezininzi. Ngoku, kufuneka ukhawuleze ngokufanelekileyo ukhuseleko yakho ngokuhambelana nezidingo zayo kunye nokugqithisa iziphumo zokusebenza. Nangona akukho izitifiketi ezintsha, kufuneka ukugcina iinkcukacha zakho ngexesha elide ukuqinisekisa ukuxhaswa okuqhubekayo. Oku kufuneka isicelo efanelekileyo leyo ivumela ukuba uthathe i-audit epheleleyo ye-design kunye ne-operating effectiveness ye-information security controls. inkqubo ye-internal audit Ukuba unayo iinkqubo ze-audit ezibonakalayo, oku kunokwenzeka ukuba unemibuzo kwiinkqubo ze-CPS 234. ‍ 
 
 
 "Ukuba i-audit ye-internal iyatholakala, ukuvelisa kunye nokulawula inkqubo eyodwa yokubuyisa kunye nokukhawuleza ukuxhaswa kwe-compliance kunokufanelekileyo ukuba ifumaneke kwiprogram ye-information security ye-organisations." U-Faisal Khan I-GRC Solutions Expert, i-Vanta E LinkedIn "Ukuba i-audit ye-internal iyatholakala, ukuvelisa kunye nokulawula inkqubo eyodwa yokubuyisa kunye nokukhawuleza ukuxhaswa kwe-compliance kunokufanelekileyo ukuba ifumaneke kwiprogram ye-information security ye-organisations." U-Faisal Khan I-GRC Solutions Expert, i-Vanta E LinkedIn Iindaba elungileyo yinto ukuba kukho iindlela ezininzi ukufumana lezi zincedisi. Isisombululo esebenzayo kuquka ukuxhaswa okuhambelana neengxaki zeengcali kunye neengxaki zeengcali, ikakhulukazi kwiindawo ezininzi ezininzi ezininzi ezininzi. Enye indlela yokulungisa ukuxhaswa kwe-CPS 234 yaye usebenzisa isisombululo se-software eyodwa. Nge-platform efanelekileyo, unako ukunciphisa umsebenzi wokugqibela kwiprosesa kwaye ukugcina i-controls yakho ngempumelelo. Ukuphumelela kunye nokuphathwa kwe-CPS 234 kunye ne-Vanta Vanta kuyinto inkxaso epheleleyo kunye nokulawulwa kwinkqubo yokulawula okuzenzakalelayo iinkqubo zokusebenza ze-compliance ezinxulumene ne-over Ngokutsho kwe-CPS 234 35 iinkqubo eziphambili kunye nemiseko It inikeza i-CPS 234 iimveliso efanelekileyo ebonakalisa ukuxhaswa ngokusebenzisa iimpawu ezininzi, ikakhulukazi: 
 
 
 
 
 
 
 Pre-configured document templates and policies 
 
 Continuous visibility of your CPS 234 compliance status 
 
 Automation and integration options for evidence collection and controls monitoring through  over [integrations_count] integrations 
 
 Access to a network of accredited auditors for support and remediation throughout the compliance process Njengoko ukulawula umgangatho we-third-party kubalulekileyo kumgangatho we-CPS 234, i-Vanta inikeza umgangatho we-CPS 234 Ukusiza ukulawula ngokuzenzakalelayo i-security posture yeentlawulo yakho kunye nokulawula ukuxhaswa kwe-CPS 234. Umthengisi Risk Management Solution Ukongezelela kwiimveliso ezihlabathi ezininzi zokusetyenziswa kwe-CPS 234, i-Vanta inikeza inkxaso olutsha lwezobugcisa ngexesha elandelayo kwinkqubo yokunciphisa iingxaki kunye nokunciphisa iingxaki zeengxaki. iimveliso ye-CPS 234 ye-Vanta ukufumana njani ukunceda ukufumana nokufumaneka. Ukubalwa kwe-Custom Demo

Le audio iveliswe ngolwimi lokuqala lwebali!

I-CPS 234 Implementation Guide Ukusebenza

About Author

IZIMVO

ZIJONGE IIMPAWU

ELI NQAKU LINIKEZELWE KU

Related Stories

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps