What It Is

LEED (Leadership in Energy and Environmental Design) is a voluntary, third-party verified green building rating framework by USGBC. It provides a performance-based system for healthy, efficient buildings across design, construction, and operations. Scope covers all building types and phases, using prerequisites for baselines and credits for improvements via weighted points.

Key Components

• Core categories: Sustainable Sites, Water Efficiency, Energy & Atmosphere (highest weighted), Materials & Resources, Indoor Environmental Quality.
• Up to 110 points total, with Innovation and Regional Priority bonuses.
• Rating systems: BD+C, ID+C, O+M, ND, Residential, Cities.
• Certification model: GBCI reviews documentation for tiers Certified (40+), Silver, Gold, Platinum.

Why Organizations Use It

Drives energy savings, risk mitigation, ESG reporting, higher asset values, tenant appeal. Voluntary but incentivized by policies, markets; builds credibility via verification.

Implementation Overview

Phased: gap analysis, scorecard, design integration, commissioning, documentation submission. Applies globally to portfolios; requires multidisciplinary teams, LCCA, recertification for O+M.

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a binding regulation from the Australian Prudential Regulation Authority, effective 1 July 2019. It requires APRA-regulated entities like banks, insurers, and super funds to maintain information security capabilities commensurate with threats and vulnerabilities to information assets. The risk-based approach emphasizes proportionality to asset criticality, sensitivity, and potential impacts on operations and stakeholders.

Key Components

• Board accountability and defined roles/responsibilities
• Information asset registers with classification by criticality/sensitivity
• Policy frameworks directing all parties including third parties
• Controls across asset lifecycle protecting CIA triad
• Incident response plans, systematic testing, internal audit assurance
• 72-hour APRA notification for material incidents; 10-day for control weaknesses No fixed controls; built on commensurate governance, testing, remediation.

Why Organizations Use It

• Mandatory compliance avoids enforcement, penalties, scrutiny
• Minimizes incident likelihood/impact, enhances resilience
• Builds trust, enables partnerships, reduces costs
• Manages third-party risks as own-accountability

Implementation Overview

Phased: gap analysis, governance/policy setup, asset/control implementation, testing/assurance, monitoring. Applies to all APRA entities/groups in Australia, scalable by size/threats. Ongoing APRA notifications, no certification but evidence-driven supervision.