Meet APRA CPS 234 with controls and evidence that stay current

CPS 234 is a legally binding prudential standard issued by the Australian Prudential Regulation Authority that sets minimum information security requirements for regulated financial institutions. It took effect on 1 July 2019. It requires Board accountability, a security capability and policy framework matched to threats, classification and protection of information assets, incident response plans, systematic control testing, internal audit review and notification of material incidents to APRA.

All APRA-regulated entities must comply with CPS 234. That includes authorised deposit-taking institutions such as banks, building societies and credit unions, general insurers, life insurers, private health insurers, RSE licensees in superannuation and authorised non-operating holding companies. Their technology and service providers are affected indirectly, because regulated entities must assess and test the security controls of third parties that manage their information assets.

An entity must notify APRA as soon as possible and no later than 72 hours after becoming aware of an information security incident that materially affected, or could have materially affected, the entity or its customers, or that has been notified to another regulator. A material control weakness that the entity expects it cannot remediate in a timely manner must be notified within 10 business days.

Non-compliance is a breach of a prudential standard and APRA can respond with supervisory action. Depending on the governing legislation, this can include formal directions, additional capital requirements, conditions on a licence, enforceable undertakings or other enforcement action. APRA has also commissioned independent CPS 234 assessments across the industry and expects entities to remediate gaps they find. The exact consequences depend on the entity and the breach.

CPS 234 extends to information assets managed by related parties and third parties. The regulated entity must assess the supplier's information security capability, evaluate the design of its controls, assess whether its testing is adequate, and have internal audit assess the assurance it provides where an incident could have a material impact. In practice, suppliers to banks, insurers and super funds face these requirements through contracts.

CPS 234 is a regulatory obligation, while ISO 27001 and SOC 2 are voluntary certification and attestation frameworks. They overlap heavily on governance, asset management, access control, incident response and testing, so an ISO 27001 management system provides a strong base. CPS 234 adds specific requirements, such as Board accountability, notification to APRA within set deadlines and internal audit review of third-party assurance.

CPS 234 is the binding prudential standard that sets what regulated entities must do, while CPG 234 is APRA's prudential practice guide that explains how APRA expects those requirements to be met. CPG 234 is not mandatory, but it describes good practice for areas such as control testing, cryptography, access management and incident response, and APRA uses it when supervising information security.

Yes. OneClickComply supports CPS 234 today, mapping its paragraphs to a single set of controls shared with frameworks such as ISO 27001. The platform collects evidence automatically, monitors controls continuously, generates policies and manages vendor risk. Our in-house audit team can help you prepare for internal audit and APRA reviews. OneClickComply does not certify compliance, as CPS 234 has no certification scheme.