CPS230 Quantum and Boards

The implementation of a modern and innovative prudential framework for Australia requires innovative thinking – and boards need to lead the charge.

The Australian Prudential Regulation Authority (APRA) recently released its anticipated consultation into the proposed cross-industry Prudential Standard CPS 230 Operational Risk Management. CPS 230 will establish minimum standards for managing operational risk, including updated requirements for business continuity and service provider management. 

APRA defines “operational risk” as “the potential for financial loss or material disruption as a result of inadequate or failed internal processes or systems, the actions of people or external drivers and events, such as a pandemic or natural disaster”. Undoubtedly, cyber risks comprise a significant part of such a risk profile.

Building upon its pioneering CPS 234 Information Security standard, released in 2019, APRA is again putting boards front and centre in managing organisational risks. In a clarion call to directors on boards of APRA-regulated entities, the discussion paper states: “the Board is ultimately accountable for the oversight of operational risk management, and is expected to ensure that senior management effectively implements and maintains the framework”. One word in that sentence – “ultimately” – draws a clear line in the sand.

In relation to cybersecurity, while it is very much a here and now issue, with PwCs’ annual CEO survey finding cyber threats are the top concern for CEOs, it is also one that will be enduring. This means that while it is essential for boards to address cyber threats in the here and now, they must also take a future-facing approach. What will the cyber threat landscape look like in one year? In five years? In 10 years?

Such an approach requires agility and a new way of thinking. And while some speculation is necessary, there are also threat vectors we know are being developed and will, in due course, be deployed.

The Australian Signals Directorate (ASD) cautiously welcomed NIST’s announcement. Importantly, it encouraged Australian organisations to anticipate future requirements and dependencies of vulnerable systems during the transition to post-quantum standards.

Another example of an emerging technology that boards should be aware of is quantum key distribution (QKD). It provides a secure way of sharing encryption keys using the properties of quantum mechanics and is designed so any ‘eavesdropping’ attempt, essentially destroying the information the attacker was attempting to steal. 

QKD is proven to be information-theoretic secure, meaning the protocol cannot be broken even by an adversary with unlimited processing power. Put simply, QKD prevents data being compromised by even the most motivated adversary.

We know cybersecurity is an issue that keeps company directors up at night. And over the past several years, we’ve seen how devastating cyber attacks can be not only for business continuity, but also for reputation. That’s why preparation is key.

CPS 230 is the latest piece of regulation in a growing list designed to lift the security of Australian organisations and, ultimately, Australia’s national security. It comes on the heels of a major overhaul of Australia’s critical infrastructure regime, which encourages an all-hazards approach to risk, with cyber a key element of broader resilience.

In the cyber world, knowledge is power and directors have to bring inquiring minds to the table. It is completely reasonable and vitally essential to ask questions and demand adequate answers, even if concerns - like the emergence of quantum technologies - seem like a problem for the future.