APRA CPS 230 Operational Risk Management
Operations

APRA CPS 230 Operational Risk Management CPS230-P25: Information and Technology Capability and Asset Health

The entity must maintain sound information and technology capability to meet current and projected business requirements and to support critical operations and risk management, and in managing technology risk must monitor the age and health of its information assets and meet the information security requirements of CPS 234.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 50 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

ISO 27002:2022 · 4 controls

  • 5.30 ICT readiness for business continuity
  • 5.9 Inventory of information and other associated assets
  • 8.6 Capacity management
  • 8.8 Management of technical vulnerabilities

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-ID.AM-02 Inventories of software, services, and systems managed by the organization are maintained
  • NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles
  • NIST-CSF-PR.IR-04 Adequate resource capacity to ensure availability is maintained
  • NIST-CSF-PR.PS-02 Software is maintained, replaced, and removed commensurate with risk

APRA CPS 234 · 3 controls

  • CPS234-15 Information Security Capability
  • CPS234-20 Information Asset Classification
  • CPS234-P17 Active Maintenance of Capability Against Change

Azure Security Benchmark · 3 controls

  • AM-3 Ensure security of asset lifecycle management
  • ASBv3-AM-1 Track asset inventory and their risks
  • ASBv3-PV-6 Rapidly and automatically remediate vulnerabilities

C5 (Germany) · 3 controls

FedRAMP High · 3 controls

  • CM-8 System Component Inventory
  • MA-6 Timely Maintenance (MA-6)
  • SA-22 Unsupported System Components (SA-22)

FedRAMP Moderate · 3 controls

  • CM-8 System Component Inventory
  • MA-6 Timely Maintenance (MA-6)
  • SA-22 Unsupported System Components (SA-22)

ISO 27001:2022 · 3 controls

  • 5.30 ICT readiness for business continuity
  • 5.9 Inventory of information and other associated assets
  • 8.6 Capacity management

NIST SP 800-161 Rev 1 · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 2 controls

  • ANSSI-HYG-34 Define an Update Policy for Information System Components
  • ANSSI-HYG-35 Anticipate the End of Maintenance of Software and Systems

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CMMC 2.0 · 2 controls

DORA · 2 controls

HIPAA Security Rule · 2 controls

SOC 2 · 2 controls

  • SOC2-A1.1 A1.1 Managing processing capacity
  • SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11)

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

You are reading one control. How much of APRA CPS 230 Operational Risk Management have you already done?

APRA CPS 230 Operational Risk Management CPS230-P25 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of APRA CPS 230 Operational Risk Management your existing evidence covers. Hold NIST Cybersecurity Framework 2.0 and 30 of 43 APRA CPS 230 Operational Risk Management controls already carry evidence.

If you hold NIST Cybersecurity Framework 2.069.8% covered · 13 gapsIf you hold DORA62.8% covered · 16 gapsIf you hold NIST SP 800-53 Rev 558.1% covered · 18 gapsIf you hold FedRAMP Moderate55.8% covered · 19 gapsIf you hold SOC 248.8% covered · 22 gapsIf you hold ISO 27001:202244.2% covered · 24 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 4 were rejected on the NIST Cybersecurity Framework 2.0 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 50 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll APRA CPS 230 Operational Risk Management controls