Implementation of controls

21. An APRA-regulated entity must have information security controls to protect its information assets, including those managed by related parties and third parties, that are implemented in a timely manner and that are commensurate with:

(a) vulnerabilities and threats to the information assets;

(b) the criticality and sensitivity of the information assets;

(c) the stage at which the information assets are within their life-cycle;[9] and

(d) the potential consequences of an information security incident.

22. Where an APRA-regulated entity’s information assets are managed by a related party or third party, the APRA-regulated entity must evaluate the design of that party’s information security controls that protects the information assets of the APRA-regulated entity.[10]