New cyber security requirements for financial services industry

To combat the rising threat of cyber-attacks and ensure entities have measures in place to maintain the integrity and security of sensitive client data, the Australia Prudential Regulation Authority (APRA) has released the new Prudential Standard CPS 234 information security. The standards are in place to ensure organisations within the financial services sector develops resilience against cyber security incidents, making certain they can respond swiftly and effectively in the event of an information security breach. The Prudential Standard CPS 234 sets out a strict and comprehensive series of requirements that entities should meet to protect themselves against information security threats. It is critical that all Australian regulated entities familiarise themselves with the requirements of CPS 234 to ensure they are compliant when the standard comes into effect on July 1, 2019.

Key takeouts

Who does CPS 234 apply to?

CPS 234 applies to all APRA-regulated entities. These include:

• Banks (authorised deposit-taking institutions (ADIs) including foreign ADI’s authorised under the banking act;
• General insurers;
• Life insurers;
• Health Insurers.

What are the requirements of CPS 234?

CPS 234 required APRA-regulated entities to:

Roles and responsibilities

• The Board is ultimately responsible for the information security of the entity
• The entity must have clearly defined information-security related roles and responsibilities, covering roles of the Board, senior management, governing bodies and individuals with responsibility for decision-making, approval, oversight, operations and other information security functions.

Information Security Capability

• The entity must maintain an information security capability commensurate to the size and extent of potential threats to its information assets.
• Entities need to ensure third parties managing their assets also have the security capability to manage these threats.
• The entity must actively manage its information security capability with respects to changes in vulnerabilities and threats resulting from changes to information assets or its business environment.

Policy framework

• The entity must have policy frameworks in place.
• The framework must provide direction on the roles of all parties responsible for maintaining information security.

Implementation of controls

• The entity must have information security controls to protect its information assets, including those managed by third parties.
• Regularly test and exercise these controls (Minimum annual testing).
• Update controls if deficiencies are identified during testing.

Incident management

• The entity must maintain plans to respond to information security incidents.
•  Response plans must include mechanisms for managing all relevant stages of an incident from detection to post-incident review
• Plans must be tested annually and reviewed to ensure it is still for for purpose

APRA Notification

• The entity must notify APRA of an information security incidents no later than 72 hours after becoming aware of an incident.
• The entity must notify APRA no later than 10 business days if a weakness within the security control is detected, which the entity expects it will not be able to re-mediate in a timely manner.

RiskLogic has expanded services to include Cyber Consulting to help entities strengthen their cyber security controls and comply with the new standards by 1 July 2019. For further discussions, book a consultation today.

Here is a challenge, which may also test your unconscious bias.

If you had to appoint one person to manage your crisis management or business continuity strategy, who would you go with?

1. A former police forensic scientist who worked in INTERPOL’s Counter Terrorism and Emerging Threats Directorate, with commendations from the FBI and the US State Department.
2. A former Australian Army officer with Honours Degrees in Biomedical Science and Biochemistry who has conducted health support operations in Australia, PNG and Bougainville.
3. A senior risk and resilience specialist with ten years in the oil and gas industry in Canada and the Middle East, a Degree in Human Geography and Criminology and a Masters in Science, Security & Organisational Risk Management.
4.  A certified Business Continuity Practitioner with a decade in business resilience and crisis management in the telecommunication, insurance and finance sectors, including experience in South East Asia.
5.  A former senior Australian diplomat who has supported Australia’s crisis response to events in Iraq, Syria, Bangladesh and Nepal, including service in Australia’s Embassy in Afghanistan.
6. An MBA qualified banking and finance executive, with 11 years across Westpac and NAB, with deep networks in boards and executives across Australia’s largest listed and private companies.

It is such a tough decision to choose only one, right?

The good news is, RiskLogic now has all these people on our national team, with six new appointments and promotions.

And if you pictured six highly qualified men, think again, because all these appointments are women.
Not only have they brought an extraordinary diversity of experience to the team, they also build on RiskLogic’s gender diversity and reinforce the value of having highly skilled women at the helm in crisis situations.

They provide our clients with an unparalleled depth of capability and ‘lived experience’ in business continuity and crisis, incident and emergency management.

So who are these talented women? Check out their full credentials on LinkedIn here:

1. Dr Rebecca Hoile, our new Senior Manager, Resilience in our new Adelaide office
2. Briony Morgan, promoted internally to Senior Manager, Resilience in our Queensland team
3. Joanne Costa (nee Hill), promoted internally to Senior Manager, Resilience in our Victorian team
4. Razia Namazie CBCI, AMBCI, our new Senior Manager, Resilience in the NSW team (returning to RiskLogic after previously working here in 2012-13)
5. Jessica Petersen, our new Manager, Resilience in our Victorian team.
6. Vanessa Jaber, our new National Client Engagement Manager

If you need help or advice in business continuity or crisis management and want to tap into the skills and experience of these extraordinary people, start a conversation with us today.

What happens if a cyber-attack shuts your systems down for days, weeks or even months? How are you going to contact your staff, stakeholders, suppliers and customers? What will be the most efficient way to get your operations back to business as usual? If you don’t have the answers this, then you don’t have a Business Continuity Plan.

Whilst you may not be able to predict every kind of event or incident that could occur, a Business Continuity Plan will help you prepare for and recover from the most likely events or incidents you could face. The lack of a Business Continuity Plan may have severe impacts on your business operations and could affect your financial viability and reputation.

If you’re still putting business continuity planning into the ‘too hard’ basket, here are 5 reasons why you should move it to the top of your priority list.

1. Minimise downtime
The primary purpose of a Business Continuity Plan is to minimise downtime. Whether you suffer from a natural disaster or a ransomware attack, the best way to stay in business is to continue business-as-usual operations as soon as possible.

2. Continue business-as-usual operations
Some Business Continuity Plans allow the business to continue business-as-usual operations during an incident by including back-up and recovery sites. These are off-site areas where critical business functions can operate from, regardless of damage or inaccessibility to the usual site.

3. Communicate confidently
In the event of an incident, you will want to establish order amongst the chaos. A Business Continuity Plan will outline a chain-of-command delegation of responsibility and outline reliable communication channels.

4. Compliance
Some industries require a business to have a well prepared and tested Business Continuity Plan to comply with industry regulations. Industries such as insurance may offer lower premiums for businesses with a robust plan.

5. Your reputation matters
When things go wrong, your shareholders, customers and the public will be watching very closely, and in the absence of information, they automatically assume the worst  The speed and effectiveness of your response could make or break your reputation.

There’s no time like the present to prepare a Business Continuity Plan for your business or review your existing plan. If you need any help, reach out to our experienced consultants. Having helped hundreds of clients since 2005, we do know a thing or two about Business Continuity Planning, so start a conversation today.

Following the Global Financial Crisis (GFC) in 2008, the Australian Government introduced the Financial Claims Scheme (FCS) to protect depositors. The Prudential Standards APS910 – Financial Claims Scheme released in 2013 required Authorised Deposit-Taking Institutions (banks, building societies and credit unions – referred to as ADIs in this article) and general insurance companies to implement measures to ensure it is adequately prepared, should it become a declared ADI for Financial Claims Scheme (FCS) purposes.

In recent years, APRA has conducted a range of activities designed to strenghten and facilitate improvement in ADI’s FCS operational preparedness levels. These activities comprised of prudential reviews, an FCS readiness survey and benchmarking exercises to review APS910 audit reports and CEO attestations. These observations highlighted gaps, leading APRA to make recommendations for improvement in APS210 to support further operational maturity.

What is APS910?

APRA Prudential Standards APS910 – Financial Claims Scheme (FCS) is an Australian Government initiative that protects depositors of authorised deposit-taking institutions and policyholders of general insurance companies, from potential loss in the unlikely event that one of these financial institutions fails. The scheme ensures that depositors do not lose their deposit, but rather be paid out by the Australian Government. Under the FCS, deposits are protected up to $250,000 per account holder at each ADI. For insurers, the Australian Government will cover up to $5000 of valid claims per policy holder. Claims above $5,000 are also covered under the FCS for eligible policyholders and certain third parties.

If the FCS is activated by the Australian Government, APRA will be responsible for administering it within 7 calendar days. For APRA to administer the FCS within this timeframe, ADIs need to provide APRA with key details of account holders within 48 hours.

Who does it affect?

APS910 applies to ADIs such as banks, building societies, credit unions and general insurance companies. A comprehensive list of Authorised Deposit-Taking institutions are available on the APRA website.

Who is ultimately responsible for APS910?

The Board and senior management of an ADI are ultimately responsible for ensuring that appropriate policies and procedures are in place to ensure the integrity of the operations, internal controls and information required under this Prudential Standard.

Why is it important now?

Whilst APS910 is not new to ADIs, compliance should be reviewed following an APRA recommendation that resulted from the Banking Royal Commission. The recommendation, supported by the government, introduces the Banking Executive Accountability Regime (BEAR). The BEAR is responsible for all steps in the design, delivery and maintenance of all products offered to customers by the ADI and any necessary remediation of customers in respect of any of their products. Furthermore, updated technical questions on the Financial Claims Scheme were published on the APRA website on September 2018, indicating a focus on ADIs and their compliance.

What do you need to do to comply*?

APRA emphasises five major areas that ADI’s need to address in order to ensure compliance with APS910.

1. Financial Claims Scheme Framework – ADIs should review FCS governance procedures to improve Board and senior management awareness and oversight (accountability and responsibility) as well as including FCS related components in an appropriate risk management framework. ADIs should also review and update operational FCS plans and integrate them with other relevant crisis related plans where appropriate.
2. FCS Testing – ADIs should ensure internal FCS testing occurs, at a minimum, in line with APRA’s testing schedule. Test results – including shortcomings with FCS-related systems, processes and reporting as well as respective causes – should be documented, along with remediation plans and timeframes.
3. Data Integrity – ADIs should thoroughly investigate and analyse FCS reporting and testing results against clearly defined tolerance levels. Timely reconciliations and checks should be performed with the generation of each report with tracking of issues, and a remediation plan linked to the risk management framework. ADIs should work to reduce exception numbers and values to acceptable levels that are within the tolerance set by the ADI.
4. Reporting – ADIs must take steps to ensure systems have the capability to be updated to reflect account holder balances post FCS payments.
5. FCS Communication – ADIs should examine the FCS information currently contained on their website and in PDS documents to ensure it is accurate, up-to-date and easily accessible. ADIs could also consider the positive benefits that FCS protection offers account holders and help to facilitate this messaging.

APRA has clarified that systems capacity, communications and testing requirements are to be in line with business continuity planning arrangements. If you haven’t reviewed your compliance to APS910 and see how it can be integrated into existing Business Continuity Plans. Reach out to our experienced consultants today.

Sources

APRA Financial Claims Scheme
APRA APS910
Federal Register of Legislation
*This section is contributed by Amy Mallick, RiskLogic Resilience specialist

The animal kingdom seems to be used more and more as a metaphor and symbol of human behaviour, both physically and psychologically. There are elephants in people’s rooms and black sheep roaming within people’s families and social groups.

Yet in the business of risk and resilience, we find ourselves facing two other animals – the ‘Grey Rhino’ and the ‘Black Swan’. The ‘grey rhino’ is a known risk or threat that people chose not to act on despite the potential for harm. It is seen as something that is present, with a series of warnings – an event that is both highly probably yet somehow neglected.

In business, this can translate to those things that directly or indirectly impact everyday operations and services including, outdated policies, conflicting procedures and practices and ongoing disputes.

By comparison, the ‘black swan’ is an event that cannot be predicted, appears seemingly out of nowhere and has a profound effect across a multitude of sectors. Examples include, the 2008 Global Financial Crisis, Japan’s Tsunami and Fukushima Daiichi nuclear disaster, terrorist attacks like 9/11, and the 2019 Christchurch shootings.

Globally, grey rhinos are being taken more seriously, with many politicians and world leaders quoted in the media, describing economic and political instabilities as ‘grey rhinos’ in the distance. The lesson we can take from this type of media exposure, is to use the opportunity to envision the grey rhino risks within our own businesses, identify the likelihood and scale of their impact and prepare adequate business recovery strategies.

Keep in mind, protection from grey rhinos is more than just a physical one. The impact of a problem that was apparently in front of you the whole time, may have cascading consequences, impacting your business culture, brand and reputation.

In terms of risk management resources, many have argued that one cannot dedicate time and resources to preparing for a Black Swan event, however, taking the time to identify the grey rhinos, and strengthening your resilience through crisis management and business continuity, will surely build a foundation from which you can react and recovery from a Black Swan that might land on your doorstep.

If you want to discuss your level of resilience preparedness, contact RiskLogic to find out how.