The mandatory prudential standard for Australian banks, insurers and superannuation funds. Board accountability, third-party risk and incident notification in 72 hours.
Prudential Standard CPS 234 is a mandatory information security standard issued by the Australian Prudential Regulation Authority (APRA). In force since 1 July 2019, it requires all APRA-regulated entities — banks, insurers and superannuation trustees — to maintain information security capabilities commensurate with the threats they face.
CPS 234 places ultimate accountability on the board, requires robust third-party risk management, mandates incident notification to APRA within 72 hours, and demands regular testing of security controls. It is backed by escalating enforcement — including capital charges for material non-compliance.
All APRA-regulated entities: authorised deposit-taking institutions (ADIs), general insurers, life companies, private health insurers, and registrable superannuation entities (RSEs). This encompasses approximately 680 entities overseeing trillions in assets. Non-regulated organisations in the supply chain are increasingly assessed against CPS 234 expectations as well.
Clearly define information security responsibilities of the board, senior management, governing bodies and individuals.
Maintain capabilities commensurate with the size and extent of threats — including third-party providers.
Maintain a policy framework proportionate to your exposures and vulnerabilities, updated as the threat landscape evolves.
Classify information assets reflecting the potential impact of a security incident on the entity and its customers.
Implement controls commensurate with the criticality, sensitivity and lifecycle stage of information assets.
Maintain and test an incident response plan. Notify APRA of material incidents within 72 hours.
Conduct systematic testing of controls, with annual review of the testing programme's sufficiency.
Internal audit must assess all aspects of the information security control environment over time.
Organisations certified to ISO 27001 have a strong foundation for CPS 234 compliance — the ISMS provides structure, documented processes and evidence trails. However, ISO 27001 alone does not satisfy CPS 234. Additional requirements include APRA notification obligations, board accountability specifics and the depth of third-party assessment that APRA expects.
APRA has also progressively established the Essential Eight as a practical technical benchmark through industry letters, particularly around MFA, daily backups and application patching.
We help APRA-regulated entities and their supply chain partners achieve and maintain CPS 234 compliance — from gap analysis and policy development through to control testing programmes and incident response planning. Our approach integrates CPS 234 with your existing ISO 27001 or Essential Eight programmes.
Discuss CPS 234 ComplianceBook a free 30-minute call with Doug. No obligation — just an honest conversation about your compliance posture and what it would take to close the gaps.
Book a Discovery Call