APRA CPS 234 and CPS 230 compliance, met with evidence your Board can stand behind.

What it is

What are APRA CPS 234 and CPS 230, and what are they used for?

CPS 234 Information Security is a prudential standard issued by the Australian Prudential Regulation Authority. It sets what an APRA-regulated entity must do to stay resilient against information security incidents, including for information assets that related parties and third parties manage.

CPS 230 Operational Risk Management sits beside it. It requires the entity to manage operational risk, keep critical operations within tolerance through disruption and manage the risks of using service providers. It also expects the entity to meet CPS 234, so the two work best as one programme.

Neither is a certifiable management system: both set obligations that APRA supervises. Practice guide CPG 234 gives APRA's view of sound security practice but creates no enforceable requirements.

Current editions. CPS 234 has applied since 1 July 2019; for information assets managed by third parties, from the next contract renewal or 1 July 2020, whichever came first. CPS 230 has applied since 1 July 2025; for service provider contracts already in place, from the next renewal or 1 July 2026, whichever came first. A revised CPS 230 with targeted amendments took effect on 1 July 2026. Confirm the current position with APRA before you plan.

Who it is for

Who needs APRA CPS 234 and CPS 230 compliance?

CPS 234 applies to every APRA-regulated entity: authorised deposit-taking institutions, including foreign ADIs, general insurers, life companies and friendly societies, private health insurers and RSE licensees. For a foreign entity, it covers the Australian branch operations. CPS 230 covers ADIs, general insurers, life companies, private health insurers and RSE licensees. Projects usually begin in one of four ways:

• A regulated customer passes the obligation down. Suppliers are asked to show their security capability and accept service provider terms, because the regulated entity must assess them.
• A tender or outsourcing contract names CPS 234 or CPS 230. Security schedules, notice periods and service provider clauses follow the standards.
• APRA or the Board asks for assurance. A supervisory review, incident or audit finding exposes gaps.
• A group structure spreads the duty. The head of a group must see that the requirements apply appropriately across it.

Requirements

What are the main APRA CPS 234 and CPS 230 requirements?

CPS 234 groups its obligations under nine headings and CPS 230 under four. This summary stays at heading level; your programme is tested against the standards themselves.

• Roles and responsibilities: the Board is ultimately responsible for information security, with defined roles for senior management and everyone with a security function.
• Information security capability: in line with the size and extent of threats, including assessment of related parties and third parties that manage your information assets.
• Policy framework: sized to your exposure to vulnerabilities and threats.
• Information asset identification and classification: by criticality and sensitivity, supplier-managed assets included.
• Implementation of controls: proportionate across each asset's life, with third-party control design evaluated.
• Incident management: timely detection and response, with response plans reviewed and tested every year.
• Testing control effectiveness: systematic testing by skilled, functionally independent specialists, reviewed at least annually.
• Internal audit: design and operating effectiveness of security controls, including those third parties maintain.
• APRA notification: no later than 72 hours after becoming aware of a notifiable incident, and no later than 10 business days for a material control weakness not remediated in a timely manner.
• CPS 230 operational risk management: operational risks identified, assessed, controlled and monitored, with operational incidents managed.
• CPS 230 business continuity: critical operations identified, tolerance levels set, and a continuity plan kept, tested and reviewed.
• CPS 230 management of service provider arrangements: a service provider policy, formal agreements, and identification and monitoring of material service providers.
• CPS 230 roles and responsibilities: Board oversight and senior management accountability for operational risk.

Compliance process

How do you achieve APRA CPS 234 and CPS 230 compliance?

There is no certificate at the end. You demonstrate compliance to your Board and to APRA, so the route builds evidence that holds up to supervision, internal audit and independent testing.

1. 01
   Confirm the entity, group, operations and asset scope.Identify which regulated entities and group members are covered, the critical operations and information assets in play, and the service providers, related parties and third parties behind them.
2. 02
   Gap analysis: compare current practice with each CPS 234 and CPS 230 heading.We review governance, policies, asset classification, controls, operational risk, business continuity, service provider agreements, incident plans, testing and internal audit coverage, then agree actions, owners and dates.
3. 03
   Close the gaps in controls, continuity and service provider oversight.Classify assets, strengthen controls in proportion, set tolerance levels for critical operations, assess supplier capability and bring service provider agreements up to the standard.
4. 04
   Test, rehearse and audit.Independent specialists test control effectiveness, response and business continuity plans are exercised, internal audit reviews design and operating effectiveness, and results reach the Board.
5. 05
   Operate the programme and report to APRA when required.Keep testing and reviews on schedule, and notify APRA whenever a threshold is met.

Check the route before you sign. CPS 234 and CPS 230 are enforced by APRA, and no certification body, consultant or software vendor can declare an entity compliant. Ask what evidence the work produces and who tests it independently. The certification buyer's checklist

Cost

How much does APRA CPS 234 compliance cost?

With no certification fee, the budget sits in the programme work, the independent testing and your own people's time.

Timeline

How long does APRA CPS 234 compliance take?

Supplier work usually sets the pace, because assessments need each party's cooperation, and response plans need a real test. As an estimate, most programmes reach a defensible position in four to nine months.

Your engagement

What your APRA CPS 234 engagement includes

Sterling OS™ runs every engagement, with each phase adapted to a prudential obligation rather than a certificate. Sterling does not certify or attest: APRA supervises compliance, and your Board remains accountable for it.

• Design™: guided support

  Your team builds the programme; a Sterling consultant sets the method, reviews every policy, register and plan, and coaches the owners.

• Drive™: managed support

  The alternative to Design™ when capacity is short: Sterling drafts the framework, registers and supplier assessments with your owners and runs the programme to Board sign-off.

• Sustain™: after the programme

  Annual plan tests, supplier reassessments and readiness for internal audit and supervisory reviews.

• Automate™: Effivity

  Your security programme runs in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Compliance decisions and any supervisory action remain with APRA.

Often combined with

Standards organisations pair with APRA CPS 234 and CPS 230

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
• BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
• CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• DORADORA compliance consulting for EU financial entities and ICT providers: ICT risk, incident reporting, resilience testing and third-party risk, evidenced.