{"id":"F2018L01745","name":"Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2018","slug":"banking-insurance-life-insurance-health-insurance-and-superannuation-prudential-standard-determinati","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":98392,"registerId":"commonwealth-F2018L01745-current","compilationNumber":null,"startDate":"2026-04-02","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Authority","sectionType":"part","heading":"Authority","content":"# Authority\n\n1.  This Prudential Standard is made under:\n\n(a) section 11AF of the Banking Act 1959 (Banking Act);\n\n(b) section 32 of the Insurance Act 1973 (Insurance Act);\n\n(c) section 230A of the Life Insurance Act 1995 (Life Insurance Act);\n\n(d) section 92 of the Private Health Insurance (Prudential Supervision) Act 2015 (PHIPS Act); and\n\n(e) section 34C of the Superannuation Industry (Supervision) Act 1993 (SIS Act).","sortOrder":0},{"sectionNumber":"Application","sectionType":"part","heading":"Application","content":"# Application\n\n2. This Prudential Standard applies to all ‘APRA-regulated entities’ defined as:\n\n(a) authorised deposit-taking institutions (ADIs), including foreign ADIs, and non-operating holding companies authorised under the Banking Act (authorised banking NOHCs);\n\n(b) general insurers, including Category C insurers, non-operating holding companies authorised under the Insurance Act (authorised insurance NOHCs), and parent entities of Level 2 insurance groups;\n\n(c) life companies, including friendly societies, eligible foreign life insurance companies (EFLICs) and non-operating holding companies registered under the Life Insurance Act (registered life NOHCs);\n\n(d) private health insurers registered under the PHIPS Act; and\n\n(e) RSE licensees under the SIS Act in respect of their business operations.[\\[1\\]](#_ftn1)\n\n3. The obligations imposed by this Prudential Standard on, or in relation to, a foreign ADI, a Category C insurer or an EFLIC apply only in relation to the Australian branch operations of that entity.\n\n4. Where an APRA-regulated entity is the ‘Head of a group’,[\\[2\\]](#_ftn2) it must comply with a requirement of this Prudential Standard:\n\n(a) in its capacity as an APRA-regulated entity;\n\n(b) by ensuring that the requirement is applied appropriately throughout the group, including in relation to entities that are not APRA-regulated; and\n\n(c) on a group basis.\n\nIn applying the requirements of this Prudential Standard on a group basis, references in paragraphs 13 to 36 to an ‘APRA-regulated entity’ are to be read as ‘Head of a group’ and references to ‘entity’ are to be read as ‘group’.\n\n5. This Prudential Standard commences on 1 July 2019, subject to paragraph 6.\n\n6. Where an APRA-regulated entity’s information assets are managed by a third party, the requirements in this Prudential Standard will apply in relation to those information assets from the earlier of the next renewal date of the contract with the third party or 1 July 2020.","sortOrder":1},{"sectionNumber":"Interpretation","sectionType":"part","heading":"Interpretation","content":"# Interpretation\n\n7. Terms that are defined in Prudential Standard APS 001 Definitions (APS 001), Prudential Standard GPS 001 Definitions (GPS 001), Prudential Standard  \nLPS 001 Definitions, Prudential Standard HPS 001 Definitions or Prudential Standard 3PS 001 Definitions appear in bold the first time they are used in this Prudential Standard.\n\n8. In this Prudential Standard, unless the contrary intention appears, a reference to an Act, Regulation or Prudential Standard is a reference to the Act, Regulation or Prudential Standard as in force from time to time.\n\n9. Where this Prudential Standard provides for APRA to exercise a power or discretion, the power or discretion is to be exercised in writing.\n\n10. For the purposes of this Prudential Standard:\n\n‘group’ means a Level 2 group or a Level 3 group, as relevant;\n\n‘Head of a group’ means a Level 2 Head or Level 3 Head, as relevant;\n\n‘Level 2 group’ means the entities that comprise:\n\n(a) Level 2 as defined in APS 001; or\n\n(b) a Level 2 insurance group as defined in GPS 001;\n\n‘Level 2 Head’ means:\n\n(a) where an ADI that is a member of a Level 2 group is not a subsidiary of an authorised banking NOHC or another ADI, that ADI;\n\n(b) where an ADI that is a member of a Level 2 group is a subsidiary of an authorised banking NOHC, that authorised banking NOHC; or\n\n(c) the parent entity of a Level 2 insurance group as defined in GPS 001.","sortOrder":2},{"sectionNumber":"Adjustments and exclusions","sectionType":"part","heading":"Adjustments and exclusions","content":"# Adjustments and exclusions\n\n11. APRA may adjust or exclude a specific prudential requirement in this Prudential Standard in relation to an APRA-regulated entity.[\\[3\\]](#_ftn3)","sortOrder":3},{"sectionNumber":"Definitions","sectionType":"part","heading":"Definitions","content":"# Definitions\n\n12. The following definitions are used in this Prudential Standard:\n\n(a) availability refers to accessibility and usability when required;\n\n(b) confidentiality refers to access being restricted only to those authorised;\n\n(c) criticality refers to the potential impact of a loss of availability;\n\n(d) information asset means information and information technology, including software, hardware and data (both soft and hard copy);\n\n(e) information security means the preservation of an information asset’s confidentiality, integrity and availability;\n\n(f) information security capability means the totality of resources, skills and controls which provide the ability and capacity to maintain information security;\n\n(g) information security control means a prevention, detection or response measure to reduce the likelihood or impact of an information security incident;\n\n(h) information security incident means an actual or potential compromise of information security;\n\n(i) information security policy framework means the totality of policies, standards, guidelines and procedures pertaining to information security;\n\n(j) information security threat (threat) is a circumstance or event that has the potential to exploit an information security vulnerability;\n\n(k) information security vulnerability (vulnerability) is a weakness in an information asset or information security control that could be exploited to compromise information security;\n\n(l) integrity refers to completeness, accuracy and freedom from unauthorised change or usage; and\n\n(m) sensitivity means the potential impact of a loss of confidentiality or integrity.","sortOrder":4},{"sectionNumber":"Roles and responsibilities","sectionType":"part","heading":"Roles and responsibilities","content":"## Roles and responsibilities\n\n13. The Board[\\[4\\]](#_ftn4) of an APRA-regulated entity (Board) is ultimately responsible for the information security of the entity. The Board must ensure that the entity maintains information security in a manner commensurate with the size and extent of threats to its information assets, and which enables the continued sound operation of the entity.[\\[5\\]](#_ftn5)\n\n14. An APRA-regulated entity must clearly define the information security-related roles and responsibilities of the Board, senior management, governing bodies and individuals with responsibility for decision\\-making, approval, oversight, operations and other information security functions.[\\[6\\]](#_ftn6)","sortOrder":5},{"sectionNumber":"Information security capability","sectionType":"part","heading":"Information security capability","content":"# Information security capability\n\n15. An APRA-regulated entity must maintain an information security capability commensurate with the size and extent of threats to its information assets, and which enables the continued sound operation of the entity.\n\n16. Where information assets are managed by a related party or third party, the APRA-regulated entity must assess the information security capability of that party, commensurate with the potential consequences of an information security incident affecting those assets.[\\[7\\]](#_ftn7)\n\n17. An APRA-regulated entity must actively maintain its information security capability with respect to changes in vulnerabilities and threats, including those resulting from changes to information assets or its business environment.","sortOrder":6},{"sectionNumber":"Policy framework","sectionType":"part","heading":"Policy framework","content":"# Policy framework\n\n18. An APRA-regulated entity must maintain an information security policy framework commensurate with its exposures to vulnerabilities and threats.\n\n19. An APRA-regulated entity’s information security policy framework must provide direction on the responsibilities of all parties who have an obligation to maintain information security.[\\[8\\]](#_ftn8)","sortOrder":7},{"sectionNumber":"Information asset identification and cla","sectionType":"part","heading":"Information asset identification and classification","content":"# Information asset identification and classification\n\n20. An APRA-regulated entity must classify its information assets, including those managed by related parties and third parties, by criticality and sensitivity. This classification must reflect the degree to which an information security incident affecting an information asset has the potential to affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers.","sortOrder":8},{"sectionNumber":"Implementation of controls","sectionType":"part","heading":"Implementation of controls","content":"# Implementation of controls\n\n21. An APRA-regulated entity must have information security controls to protect its information assets, including those managed by related parties and third parties, that are implemented in a timely manner and that are commensurate with:\n\n(a) vulnerabilities and threats to the information assets;\n\n(b) the criticality and sensitivity of the information assets;\n\n(c) the stage at which the information assets are within their life\\-cycle;[\\[9\\]](#_ftn9) and\n\n(d) the potential consequences of an information security incident.\n\n22. Where an APRA-regulated entity’s information assets are managed by a related party or third party, the APRA-regulated entity must evaluate the design of that party’s information security controls that protects the information assets of the APRA-regulated entity.[\\[10\\]](#_ftn10)","sortOrder":9},{"sectionNumber":"Incident management","sectionType":"part","heading":"Incident management","content":"# Incident management\n\n23. An APRA-regulated entity must have robust mechanisms in place to detect and respond to information security incidents in a timely manner.\n\n24. An APRA-regulated entity must maintain plans to respond to information security incidents that the entity considers could plausibly occur (information security response plans).\n\n25. An APRA-regulated entity’s information security response plans must include the mechanisms in place for:\n\n(a) managing all relevant stages of an incident, from detection to post-incident review; and\n\n(b) escalation and reporting of information security incidents to the Board, other governing bodies and individuals responsible for information security incident management and oversight, as appropriate.\n\n26. An APRA-regulated entity must annually review and test its information security response plans to ensure they remain effective and fit-for-purpose.","sortOrder":10},{"sectionNumber":"Testing control effectiveness","sectionType":"part","heading":"Testing control effectiveness","content":"# Testing control effectiveness\n\n27. An APRA-regulated entity must test the effectiveness of its information security controls through a systematic testing program. The nature and frequency of the systematic testing must be commensurate with:\n\n(a) the rate at which the vulnerabilities and threats change;\n\n(b) the criticality and sensitivity of the information asset;\n\n(c) the consequences of an information security incident;\n\n(d) the risks associated with exposure to environments where the APRA-regulated entity is unable to enforce its information security policies;[\\[11\\]](#_ftn11) and\n\n(e) the materiality and frequency of change to information assets.\n\n28. Where an APRA-regulated entity’s information assets are managed by a related party or a third party, and the APRA-regulated entity is reliant on that party’s information security control testing, the APRA-regulated entity must assess whether the nature and frequency of testing of controls in respect of those information assets is commensurate with paragraphs 27(a) to 27(e) of this Prudential Standard.[\\[12\\]](#_ftn12)\n\n29. An APRA-regulated entity must escalate and report to the Board or senior management any testing results that identify information security control deficiencies that cannot be remediated in a timely manner.\n\n30. An APRA-regulated entity must ensure that testing is conducted by appropriately skilled and functionally independent specialists.\n\n31. An APRA-regulated entity must review the sufficiency of the testing program at least annually or when there is a material change to information assets or the business environment.","sortOrder":11},{"sectionNumber":"Internal audit","sectionType":"part","heading":"Internal audit","content":"# Internal audit\n\n32. An APRA-regulated entity’s internal audit activities must include a review of the design and operating effectiveness of information security controls, including those maintained by related parties and third parties (information security control assurance).\n\n33. An APRA-regulated entity must ensure that the information security control assurance is provided by personnel appropriately skilled in providing such assurance.\n\n34. An APRA-regulated entity’s internal audit function must assess the information security control assurance provided by a related party or third party where:\n\n(a) an information security incident affecting the information assets has the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; and\n\n(b) internal audit intends to rely on the information security control assurance provided by the related party or third party.[\\[13\\]](#_ftn13)","sortOrder":12},{"sectionNumber":"APRA notification","sectionType":"part","heading":"APRA notification","content":"# APRA notification\n\n35. An APRA-regulated entity must notify APRA as soon as possible and, in any case, no later than 72 hours, after becoming aware of an information security incident that:\n\n(a) materially affected, or had the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers; or\n\n(b) has been notified to other regulators, either in Australia or other jurisdictions.[\\[14\\]](#_ftn14)\n\n36. An APRA-regulated entity must notify APRA as soon as possible and, in any case, no later than 10 business days, after it becomes aware of a material information security control weakness which the entity expects it will not be able to remediate in a timely manner.","sortOrder":13}],"analysis":{"flash_summary_failed":{"failed":true,"reason":"Unauthenticated. Configure AI_GATEWAY_API_KEY or use a provider module. Learn more: https://ai-sdk.dev/unauthenticated-ai-gateway","source":"analysis-cron"},"kimi_summary":{"content_quality":"ok","complexity_score":5,"scope_assessment":{"changed":false,"description":"The legislation appears consistent with its original intent as a prudential standard for information security across APRA-regulated entities. It applies broadly across banking, insurance, and superannuation sectors as indicated by its title and authority provisions, without obvious scope creep beyond the stated purpose of establishing information security requirements."},"complexity_factors":["Cross-references to 5 different Acts (Banking Act 1959, Insurance Act 1973, Life Insurance Act 1995, PHIPS Act 2015, SIS Act 1993) and 5 different definition standards (APS 001, GPS 001, LPS 001, HPS 001, SPS 001)","13 defined terms in the dedicated Definitions section plus reliance on external definition standards","Conditional application rules for foreign entities (paragraph 3) and group-level compliance (paragraph 4) requiring re-reading of later provisions with substituted terms","Staggered commencement dates (1 July 2019 generally, 1 July 2020 or contract renewal for third-party managed assets in paragraph 6)","Multiple nested conditions for third-party arrangements (paragraphs 16, 22, 28, 34) requiring assessment of related party and external service provider security capabilities","APRA discretionary powers for adjustments and exclusions (paragraph 11) creating regulatory uncertainty","14 footnote references suggesting extensive explanatory material or cross-references not fully visible in the extract"],"plain_english_summary":"This law imposes mandatory cybersecurity rules on Australia’s major financial institutions—banks, insurers, superannuation funds and their parent companies—requiring boards to ensure systems and data are protected against hacks, failures and other digital threats.  \n\nInstitutions must identify critical assets, implement proportionate technical controls, test and audit defenses, oversee third-party providers, maintain incident-response plans, and notify APRA quickly about serious incidents or unresolved vulnerabilities."},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"The instrument sets a comprehensive, cross‑sector scope that applies to all APRA‑regulated entities as defined (paras 2–3) and requires group‑level application where an entity is the Head of a group (para 4). The text does not indicate a change from a prior stated scope; it clarifies application to Australian branches of foreign entities and phased application for third‑party managed assets (paras 3, 6)."},"complexity_factors":["Broad cross‑sector scope covering ADIs, general insurers, life companies, private health insurers and RSE licensees (Application, paras 2–3)","Board‑level accountability and group‑level application for Heads of groups (paras 13–14, 4, 10)","Detailed definitions and multi‑dimensional risk concepts (availability, confidentiality, integrity, criticality, sensitivity) that drive implementation (para 12)","Mandatory third‑party assessment and phased application tied to contract renewal dates (paras 6, 16, 21–22)","Prescriptive testing, audit and independence requirements (paras 27–31, 32–34)","Incident response planning, annual testing and specific notification timeframes (paras 24–26, 35–36)","APRA discretion to adjust or exclude specific prudential requirements in writing (para 11)","Requirement to apply standards proportionate to asset life‑cycle and changing vulnerabilities (paras 15, 17, 21(c), 27(a), 31)"],"plain_english_summary":"This Prudential Standard requires APRA‑regulated financial firms — banks, general and life insurers, private health insurers and superannuation trustees — to maintain information security measures proportionate to threats and the sensitivity and criticality of their information assets. Boards are ultimately responsible and must ensure policies, asset classification, controls, testing, incident response and third‑party oversight are in place, and notify APRA of material incidents within 72 hours or control weaknesses within 10 business days.\n\nAffected entities bear the compliance costs and must strengthen governance, testing and vendor management; APRA may adjust or exclude requirements in writing."}},"importantCases":[],"_links":{"self":"/api/acts/banking-insurance-life-insurance-health-insurance-and-superannuation-prudential-standard-determinati","history":"/api/acts/banking-insurance-life-insurance-health-insurance-and-superannuation-prudential-standard-determinati/history","analysis":"/api/acts/banking-insurance-life-insurance-health-insurance-and-superannuation-prudential-standard-determinati/analysis","conflicts":"/api/acts/banking-insurance-life-insurance-health-insurance-and-superannuation-prudential-standard-determinati/conflicts","importantCases":"/api/acts/banking-insurance-life-insurance-health-insurance-and-superannuation-prudential-standard-determinati/important-cases","documents":"/api/acts/banking-insurance-life-insurance-health-insurance-and-superannuation-prudential-standard-determinati/documents"}}