CRN reports that APRA is losing patience with regulated entities:

"Three years ago, APRA’s information security standard CPS 234 came into force, and yet many entities are still struggling with foundational issues: ensuring third party controls are effective, making sure that systematic security control testing is in place, and regularly testing incident response plans," APRA Chair Lonsdale said.

"With the potential for serious impact to millions of Australians, our patience has run out."

Don’t forget that APRA not only focuses on regulated entities such as banks, insurers and superannuation companies, but also on the suppliers of material services to these entities.

In July, APRA also announced the new standard “CPS 230 Operational Risk Management”.

Chair John Lonsdale said “We expect regulated entities to be proactive in preparing for implementation, rather than waiting until the last minute to get ready to meet the new requirements. There will be a transition phase for existing contractual arrangements with material service providers for entities that need some flexibility.”

The key to becoming CPS 230 compliant is to start now! There is a lot to do and July 2025 will come around very quickly.

APRA

• APRA has suspended the majority of its planned policy and supervision initiatives and priorities in response to COVID-19. This response is intended to support APRA-regulated entities to maintain their operations.
• APRA has also suspended public consultations on revisions to the prudential framework until 30 September 2020 (presumably this will include CPS 511 Remuneration). It is unclear yet how this will affect the timeline for FAR implementation (if at all).
• APRA requires ADIs to advise of the reporting treatment for COVID-19 loans and publicly disclose the nature and terms of any repayment deferrals and the volume of COVID-19 loans. Banks have offered COVID-19 loans to affected small business and home loan customers which provides them with an option to defer their repayment for up to six months.
• APRA noted that COVID-19 loans will not be regarded as restructured and the repayment deferral period will not be treated as a period of arrears. APRA confirmed that the Coronavirus SME Guarantee Scheme (see below) will be an eligible guarantee by the government for risk-weighting purposes.

COFR

• COFR noted it is holding regular meetings to ensure coordinated regulatory response to COVID-19 to support credit flow e.g. noting that RBA has announced measures to provide liquidity to financial markets; APRA has announced temporary changes to its expectations on bank capital ratios;ASIC has introduced measures to ensure equity market participants' manage transaction volumes; and APRA and ASIC have reprioritised their regulatory work to minimise the regulatory burden upon institutions.

ASIC

• ASIC will focus its regulatory efforts on challenges crated by the COVID-19 pandemic. Until at least 30 September 2020, the other matters that ASIC will afford priority are where there is the risk of significant consumer harm, serious breaches of the law, risks to market integrity and time-critical matters.
• ASIC has suspended near-term activities which are not time-critical (such as consultation, regulatory reports and reviews).
• ASIC will work with financial institutions to further accelerate the payment of outstanding remediation to customers. It will also maintain its enforcement activities and continue to investigate and take action where the public interest warrants it to do so.
• ASIC will also take account of the circumstances in which lenders, acting reasonably, are currently operating when administering the law.

Government

• The Government will establish the Coronavirus SME Guarantee Scheme. Under the Scheme, the Government will guarantee 50 per cent of new loans by eligible lenders to SMEs. This will result in the Government guaranteeing up to $20 billion to support $40 billion in SME loans.

Read more from the Government

Read more from ASIC

NAB has revealed for the first time how it secured the Australian Prudential Regulation Authority’s blessing to operate in the cloud at scale.

‘While disclosure is critical, it is but one aspect of prudent corporate governance practices in connection with the mitigation of legal risks. Directors should be able to demonstrate that they have met their legal obligations in considering, managing and disclosing all material risks that may affect their companies. This includes any risks arising from climate change, be they physical or transitional risks.’ Mr Price said.

Download and read the update here.

New York stock exchange penalised for violating their disaster recovery and business continuity requirements ... 

Experts are reporting that thousands of Australian businesses aren't ready to comply with the data breach mandatory notification law that kicked in from February 22. Research by cyber security specialists CyberArk concluded that as many as 44 per cent of enterprises aren't up to speed, and other security professionals are queuing up to echo the sentiment.

The new law is simple enough in principle. It's compliance in practice that will cause headaches.

If your organisation is covered by the Privacy Act, and you have other people's personal information in your care, and it ends up somewhere or with someone it shouldn't, there's a clock ticking.

AFR | February 1

Mandatory reporting of data breaches will require any company, with an annual turnover of more than $3 million and is subject to the Privacy Act, to notify a person if their information has been compromised.

Big Law Business | 17 September

With data breaches becoming an unfortunate everyday occurrence, cybersecurity is no longer just an IT issue. Legal departments, which have a need to protect sensitive information, such as employees’ and clients’ personally identifiable information and nonpublic corporate information, are increasingly becoming involved in data security issues as the universe of risk exposure expands.