Testing control effectiveness

27. An APRA-regulated entity must test the effectiveness of its information security controls through a systematic testing program. The nature and frequency of the systematic testing must be commensurate with:

(a) the rate at which the vulnerabilities and threats change;

(b) the criticality and sensitivity of the information asset;

(c) the consequences of an information security incident;

(d) the risks associated with exposure to environments where the APRA-regulated entity is unable to enforce its information security policies;[11] and

(e) the materiality and frequency of change to information assets.

28. Where an APRA-regulated entity’s information assets are managed by a related party or a third party, and the APRA-regulated entity is reliant on that party’s information security control testing, the APRA-regulated entity must assess whether the nature and frequency of testing of controls in respect of those information assets is commensurate with paragraphs 27(a) to 27(e) of this Prudential Standard.[12]

29. An APRA-regulated entity must escalate and report to the Board or senior management any testing results that identify information security control deficiencies that cannot be remediated in a timely manner.

30. An APRA-regulated entity must ensure that testing is conducted by appropriately skilled and functionally independent specialists.

31. An APRA-regulated entity must review the sufficiency of the testing program at least annually or when there is a material change to information assets or the business environment.