Overview
APRA's binding information security standard for banks, insurers and super funds. Board is ultimately accountable for information security.
Australian context
Applies to all APRA-regulated entities. Requires notification of material incidents to APRA within 72 hours and control weaknesses within 10 business days.