Australia Consumer Data Right: every control, and what you already have

24 controls 28 frameworks share controls with it Australia verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

Australia Consumer Data Right Banking Evidence & Implementation Kit

24 controls is the documentation set somebody has to write. This is that set, already written: an adopt-ready artifact for every control in policy and procedure text you edit rather than draft, and the evidence checklist an auditor asks for against each.

See what is in it, $249

The same set every buyer of this kit receives. Nothing here is produced on request.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
GDPR	24	measure it →
APEC Cross-Border Privacy Rules (CBPR) System	23	measure it →
ISO 27701:2019	23	measure it →
NIST SP 800-53 Rev 5	21	measure it →
SOC 2	20	measure it →
FedRAMP High	18	measure it →
FedRAMP Moderate	18	measure it →
NIST SP 800-161 Rev 1	17	measure it →
NIST SP 800-53 Rev 5 MODERATE	17	measure it →
NIST SP 800-53 Revision 5.1 HIGH	17	measure it →
Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1	16	measure it →
ISO 27001:2022	15	measure it →

Every control

Code	Control	Also in
`AUCDR-IS-1`	Limit risk of unauthorised access to the CDR data environment	26
`AUCDR-IS-2`	Secure the network and systems within the data environment	25
`AUCDR-IS-3`	Securely manage information assets over their lifecycle	26
`AUCDR-IS-4`	Formal vulnerability management program	26
`AUCDR-IS-5`	Limit, prevent, detect and remove malware	25
`AUCDR-IS-6`	Information security training and awareness program	23
`AUCDR-IS-STEP1`	Step 1 - Define and implement security governance for CDR data	23
`AUCDR-IS-STEP2`	Step 2 - Define the boundaries of the CDR data environment	24
`AUCDR-IS-STEP3`	Step 3 - Have and maintain an information security capability	23
`AUCDR-IS-STEP4`	Step 4 - Implement a formal controls assessment program	24
`AUCDR-IS-STEP5`	Step 5 - Manage and report security incidents	24
`AUCDR-PS-1`	Privacy Safeguard 1 - Open and transparent management of CDR data	16
`AUCDR-PS-10`	Privacy Safeguard 10 - Notifying of the disclosure of CDR data	7
`AUCDR-PS-11`	Privacy Safeguard 11 - Quality of CDR data	13
`AUCDR-PS-12`	Privacy Safeguard 12 - Security of CDR data and destruction or de-identification of redundant CDR data	25
`AUCDR-PS-13`	Privacy Safeguard 13 - Correction of CDR data	8
`AUCDR-PS-2`	Privacy Safeguard 2 - Anonymity and pseudonymity	7
`AUCDR-PS-3`	Privacy Safeguard 3 - Seeking to collect CDR data from CDR participants	6
`AUCDR-PS-4`	Privacy Safeguard 4 - Dealing with unsolicited CDR data	6
`AUCDR-PS-5`	Privacy Safeguard 5 - Notifying of the collection of CDR data	6
`AUCDR-PS-6`	Privacy Safeguard 6 - Use or disclosure of CDR data	11
`AUCDR-PS-7`	Privacy Safeguard 7 - Use or disclosure of CDR data for direct marketing	4
`AUCDR-PS-8`	Privacy Safeguard 8 - Overseas disclosure of CDR data	17
`AUCDR-PS-9`	Privacy Safeguard 9 - Adoption or disclosure of government related identifiers	7

Tell me when Australia Consumer Data Right files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Correction request process
Records of corrections
Notification of correction to third parties where required
Records of corrections made
Correction/amendment process
Notification of corrections to third parties
Overseas disclosure assessment
Contractual safeguards with overseas recipients
Records of cross-border disclosures (APP 8.4)
Overseas-disclosure due diligence + contractual safeguards

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Correction requests not actioned named by 4 frameworks
Overseas disclosure without safeguards named by 3 frameworks
No complaints process named by 3 frameworks

What this page is

A control-level reference for Australia Consumer Data Right, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition