Framework overlap

Does APRA CPS 234 cover ISO/IEC 30111:2019?

You hold APRA CPS 234 and have been told to do ISO/IEC 30111:2019. Here is how much overlaps, control by control.

21% of ISO/IEC 30111:2019 you already have

APRA CPS 234 already covers about 21% of ISO/IEC 30111:2019, leaving 22 of 28 controls as genuinely new work.

Already covered 2 Likely covered 4 New work 22

What is genuinely new work

Nothing in APRA CPS 234 reaches these. This is the list to scope.

30111-5.4
Integration with disclosure process
30111-6.1
Vulnerability Handling Policy
30111-6.10
Tracking and Status Reporting
30111-6.11
Coordination with Disclosure Process
30111-6.12
Root Cause Analysis
30111-6.13
Metrics and Programme Performance
30111-6.14
Records Retention and Auditability
30111-6.15
Roles, Responsibilities, and Resourcing
30111-6.16
Training for Handling Personnel
30111-6.17
Customer Notification and Support
30111-6.2
Vulnerability Receipt and Initial Assessment
30111-6.3
Verification and Reproduction
30111-6.4
Severity and Impact Analysis
30111-6.6
Patch Development and Code Review
30111-6.7
Fix Verification Testing
30111-6.8
Release Management and Distribution
30111-6.9
Supplier and Component Coordination
30111-7.1
Tracking and prioritization
30111-7.2
Communication management
30111-7.4
Process documentation and improvement
30111-8.2
Lessons learned
30111-8.3
Root cause analysis
Show the 6 you already have
30111-5.1
Organizational policy
30111-5.2
Vulnerability handling team
30111-5.3
Roles and responsibilities
30111-6.5
Remediation Strategy Selection
30111-7.3
Quality assurance of remediation
30111-8.1
Post-release monitoring

How this is calculated

Already covered means a mapping runs from a control in APRA CPS 234 to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair ยท Today's edition