The Australian Prudential Regulation Authority (APRA) today released an information paper on prudential considerations and key principles in relation to outsourcing involving shared computing services, including cloud.
The information paper uses the term ‘shared computing services’ (whether labelled cloud or otherwise) to differentiate arrangements which involve the sharing of IT assets (including hardware, software and/or data storage) with other parties, from those where IT assets are dedicated to a single entity.
The use of shared computing services by APRA regulated entities is expected to continually evolve, along with the maturity of the risk management and mitigation techniques applied. APRA therefore encourages ongoing dialogue with industry participants to ensure prudent practices are in place and risks are adequately mitigated when regulated entities seek the advantages that shared computing services may realise.
While shared computing services may bring benefits, such as economies of scale, they also bring associated risks. These can vary considerably depending on the particular usage. Low risk usages are those involving IT assets with low criticality and sensitivity. Other usages involve heightened risk, such as the exposure of highly critical and/or highly sensitive IT assets to ‘un-trusted’ environments, necessitating a greater degree of caution and supervisory interest. For these arrangements, APRA encourages prior consultation.
The information paper also discusses weaknesses that APRA has identified as part of its ongoing supervisory activities, reflecting that risk management and mitigation techniques are yet to fully mature in this area. In particular, it is not readily evident that ‘public cloud’ arrangements have reached a level of maturity commensurate with usages having an extreme impact if disrupted.
Usages having an extreme impact if disrupted include, in particular, hosting systems of record holding information essential to determining obligations to customers (such as customer identity, current balance/benefits and transaction history).
Copies the information paper are available on the APRA website at: www.apra.gov.au/adi/Publications/Pages/other-information-for-adis.aspx
The Australian Prudential Regulation Authority (APRA) is the prudential regulator of the Australian financial services industry. It oversees Australia’s banks, credit unions, building societies, life and general insurance companies and reinsurance companies, private health insurance, friendly societies and most of the superannuation industry. APRA is funded largely by the industries that it supervises. It was established on 1 July 1998. APRA currently supervises institutions holding $4.9 trillion in assets for Australian depositors, policyholders and superannuation fund members.
Media and industry enquiries only:
APRA Media Unit
Telephone: 02 9210 3636
All other inquiries:
APRAinfo: 1300 55 88 49