Incident management

23. An APRA-regulated entity must have robust mechanisms in place to detect and respond to information security incidents in a timely manner.

24. An APRA-regulated entity must maintain plans to respond to information security incidents that the entity considers could plausibly occur (information security response plans).

25. An APRA-regulated entity’s information security response plans must include the mechanisms in place for:

(a) managing all relevant stages of an incident, from detection to post-incident review; and

(b) escalation and reporting of information security incidents to the Board, other governing bodies and individuals responsible for information security incident management and oversight, as appropriate.

26. An APRA-regulated entity must annually review and test its information security response plans to ensure they remain effective and fit-for-purpose.