What It Is

Six Sigma is a data-driven process improvement framework, anchored by ISO 13053:2011, focusing on defect prevention and variation reduction. It employs the DMAIC (Define, Measure, Analyze, Improve, Control) methodology for existing processes and DMADV for new designs, targeting 3.4 defects per million opportunities.

Key Components

• Structured DMAIC/DMADV phases with mandatory deliverables like project charters, SIPOC maps, and FMEAs.
• **Belt hierarchyChampions, Master Black Belts, Black Belts, Green Belts.
• Statistical tools including MSA, hypothesis testing, DOE, and SPC.
• Governance via tollgates, control plans; certification through bodies like ASQ.

Why Organizations Use It

Drives financial savings (e.g., GE's $1B+), customer satisfaction, and risk reduction. Voluntary adoption boosts competitiveness; integrates with Lean/ISO for compliance. Builds data-driven culture and stakeholder trust.

Implementation Overview

Phased rollout: executive sponsorship, training, project portfolio, DMAIC execution. Suits all sizes/industries; 6-12 months initial, ongoing sustainment. No universal certification, but ASQ CSSBB benchmarks competence. (178 words)

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a mandatory prudential regulation for Australian financial institutions regulated by APRA. Effective from 1 July 2019, it requires entities to maintain information security capabilities commensurate with threats and vulnerabilities, minimizing impacts on confidentiality, integrity, and availability (CIA) of information assets, including those managed by third parties. It adopts a risk-based, assurance-driven approach focused on governance, controls, testing, and rapid notification.

Key Components

• **GovernanceBoard ultimate responsibility, defined roles, policy framework.
• **Risk ManagementAsset classification by criticality/sensitivity, third-party assessments.
• **ControlsLifecycle protections, detection/response mechanisms.
• **AssuranceSystematic testing, internal audit reviews.
• **Reporting72-hour material incident notifications, 10-day control weakness alerts. Outcomes-focused, no fixed control count; aligns with ISO 27001/NIST.

Why Organizations Use It

• Ensures regulatory compliance avoiding penalties and scrutiny.
• Enhances cyber resilience and operational continuity.
• Manages third-party risks effectively.
• Builds stakeholder trust, reduces incident impacts.

Implementation Overview

Phased: gap analysis, asset inventory, policy/controls, testing programs, assurance. Targets APRA-regulated banks, insurers, super funds; proportional to size/risk. Ongoing internal audit, no certification but APRA supervision.