APRA CPS 220 Risk Management
RMF

APRA CPS 220 Risk Management CPS220-P23: Minimum Contents of the Risk Management Framework

The risk management framework must include at least a risk appetite statement, a risk management strategy, a business plan, policies and procedures supporting clearly defined and documented roles, responsibilities and formal reporting structures for managing material risks throughout the institution, a designated risk management function meeting the required criteria, an Internal Capital Adequacy Assessment Process, a management information system adequate in normal and stressed conditions for measuring, assessing and reporting all material risks, and a review process confirming the framework is effective.

What else in your programme already covers this

This control maps to 14 controls across 5 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • NIST-CSF-GV.RM-02 Risk appetite and risk tolerance statements are established, communicated, and maintained
  • NIST-CSF-GV.RM-05 Lines of communication across the organization are established for cybersecurity risks, including risks from suppliers and other third parties
  • NIST-CSF-GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced

SOC 2 · 4 controls

  • SOC2-CC1.3 COSO principle 3: Management establishes structures, reporting lines, and authorities
  • SOC2-CC1.5 COSO principle 5: Holds individuals accountable for internal control responsibilities
  • SOC2-CC2.2 COSO principle 14: Internally communicates information including objectives and responsibilities
  • SOC2-CC5.3 COSO principle 12: Deploys control activities through policies and procedures

NIST SP 800-53 Rev 5 · 3 controls

  • NIST800-PM-1 Information Security Program Plan. Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program and a description of the security program management controls and
  • NIST800-PM-28 Risk Framing. Identify and document: Assumptions affecting risk assessments, risk responses, and risk monitoring; Constraints affecting risk assessments, risk responses, and risk monitoring; Priorities and trade-offs considered by the organization for managing risk; and
  • NIST800-PM-9 Risk Management Strategy. Develops a comprehensive strategy to manage: Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and Privacy risk

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

NIST SP 800-161 Rev 1 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in RMF

Query this from an agent

The graph holds this control, the 14 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll APRA CPS 220 Risk Management controls