CyberStack

Glossary

AllIRacsc-glossaryaiattack-pathau-compliancecloudconceptscryptodetectiondnsframeworkshardeningidentityloggingmalwarenetworkphishingpractitionerprivacyresiliencesocisupply-chainthreat-intelvulnerabilitywindows

7 entries

practitioner au-compliance resilience supply-chain

APRA CPS 230: operational resilience, critical operations and the 24-hour, 72-hour and 20-day notices

CPS 230 is APRA's operational risk standard for banks, insurers, private health insurers and super trustees. It asks each entity to name its critical operations, set how long and how badly each may be disrupted, prove it can stay inside those limits through a severe disruption, and manage the suppliers it depends on. Here is what it requires, the three notices it creates, and how it sits beside CPS 234.

practitioner hardening supply-chain

Browser extension supply chain

Chrome and Edge auto-update means a bought extension can turn hostile overnight. Inventory, least privilege, and remove what you do not need.

practitioner au-compliance IR supply-chain

CIRMP annual report

Board-approved CIRMP annual attestation under SOCI Part 2A/2AA. FY 2025–26 90-day window closed 28 September 2026 — if you missed it, treat late lodging as a compliance failure and close the evidence pack now.

practitioner au-compliance supply-chain cloud

Hosting Certification Framework (HCF): which hosting Australian Government data needs, and what Strategic vs Assured means

The Commonwealth rule set for where sensitive government data may live. Sensitive data, whole-of-government systems and PROTECTED systems must sit on HCF-certified services; Strategic certification gives the most ownership and control protection, Assured less, Uncertified almost none. New registrations have been paused since 3 November 2025 while the framework is reformed.

practitioner hardening supply-chain

SBOM and build-pipeline checklist

Software bill of materials plus the CI controls that make it useful. Inventory what you ship, who can publish, and how fast you can patch a dependency.

practitioner network crypto hardening supply-chain IR

When a certificate authority is distrusted: trust-store response runbook

What to do when a certificate authority's keys are compromised or a root program stops trusting it. Browsers fix themselves within hours; the long tail is everything else that carries its own copy of the trust store, plus any of your own certificates that chain to the distrusted CA.

practitioner identity cloud supply-chain IR

When a platform holding your secrets is breached: secrets rotation runbook

Hosting platforms, CI/CD services and AI gateways keep your API keys, database passwords and registry tokens. When one of them reports a breach, assume every secret it held is exposed, and remember that a secret is only dead once the service that issued it has revoked it.

Definitions informed by ASD's ACSC glossary. cyber.gov.au glossary