Material control weakness report
None of the held texts sets a fixed period on this consumer; every row below reads no period set by the text. Paste one job that feeds this consumer, for example control_weakness_escalation, weekly, and the register reads its period against the clocks below, names the gap in hours, and carries the question for its owner.
Matched on the job name or the consumer column by these words: control weakness, weakness report, control deficien, deficiency report, control weakness report. The clocks on this class run from the event, not from a schedule, so the register asks for the drill or exercise job that proves the pack can be produced in time.
The clock each rule sets
| Regime | Clock | Clause |
|---|---|---|
| CPS 234 | no clock | CPS 234 para 36 APRA Notification of Material Control Weakness within 10 Business Days10 business days after becoming aware |
| no clock | CPS 234 para 28 Escalation of Unremediated Testing Deficiencies | |
| PCI DSS | no clock | PCI DSS 10.7.2 Critical security control failure detection (all entities)promptly |
Questions this page answers
How often does APRA CPS 234 require material control weakness report?
The held text of CPS 234 para 36 (APRA Notification of Material Control Weakness within 10 Business Days) sets no fixed period: 10 business days after becoming aware. The held text of CPS 234 para 28 (Escalation of Unremediated Testing Deficiencies) sets no fixed period: no period set by the text. APRA must be notified as soon as possible and no later than 10 business days after the entity becomes aware of a material information security control weakness it expects it will not be able to remediate in a timely way. Testing results that identify control deficiencies which cannot be remediated in a timely way must be escalated and reported to the Board or senior management.
How often does PCI DSS v4.0 require material control weakness report?
The held text of PCI DSS 10.7.2 (Critical security control failure detection (all entities)) sets no fixed period: promptly. Failures of critical security control systems are detected, alerted, and addressed promptly for all entities (not just service providers), with documented response procedures.
What does the register ask the owner of a material control weakness report job?
Which weaknesses in the last run could not be remediated in a timely way, and were they escalated to the board?
The clauses in full
APRA must be notified as soon as possible and no later than 10 business days after the entity becomes aware of a material information security control weakness it expects it will not be able to remediate in a timely way.
What an assessor asks to see: Notification records with awareness dates; Weakness register with materiality and remediation feasibility assessments; Evidence linking testing and audit findings to notification decisions. Where it usually falls short: No process connecting the weakness register to the notification duty
Testing results that identify control deficiencies which cannot be remediated in a timely way must be escalated and reported to the Board or senior management.
What an assessor asks to see: Escalation records for unremediated deficiencies; Board or senior management reporting packs; Remediation tracker with timeliness assessment. Where it usually falls short: Deficiencies tracked operationally but never escalated
Failures of critical security control systems are detected, alerted, and addressed promptly for all entities (not just service providers), with documented response procedures.
What an assessor asks to see: Documented list of critical security controls; Health monitoring configuration per control; Alert routing to on-call; Sample failure tickets with response evidence. Where it usually falls short: List of critical controls missing
Requirement text quoted from the standards themselves, published at compliance.theartofservice.com, the same publisher as this register, read against the held text of each standard: our statement of each clause, not the instrument verbatim. Run this job through the register