APRA CPS 234 compliance must be demonstrated with evidence that required controls are designed, operating and tested. Policies alone are not enough.
The standard has applied to APRA-regulated entities since 1 July 2019. Since then, APRA has used independent assessments and ongoing supervision to test whether the information security controls entities describe are actually in place and working.
CPS 234 is principles-based. It does not prescribe a single control framework or technology stack. Instead, it requires each entity to maintain information security capability that is commensurate with the threats to its information assets. The entity must be able to justify what “commensurate” means for its environment, customers and risk profile.
This guide explains what CPS 234 requires, how it applies across information security and IT operations, the evidence APRA may expect and where organisations should start.
What is APRA CPS 234?
CPS 234 Information Security is a binding APRA prudential standard. Its purpose is to ensure regulated entities are resilient against information security incidents by maintaining capability appropriate to their vulnerabilities and threats.
It applies across APRA-regulated banking, insurance, private health insurance and superannuation entities. This includes authorised deposit-taking institutions, general and life insurers, private health insurers, RSE licensees and relevant non-operating holding companies and group heads. For certain foreign entities, the requirements apply to their Australian branch operations.
Its scope is broader than IT security. CPS 234 defines information assets as information and information technology, including software, hardware and data in both electronic and hard-copy form. It therefore reaches across technology, data, people, processes, governance and third-party arrangements.
The requirements also extend beyond an entity’s own network. Where information assets are managed by a related party or third party, the regulated entity remains responsible for assessing that party’s information security capability, evaluating the design of relevant controls and obtaining appropriate assurance that those controls work.
CPS 234 is supported by CPG 234 Information Security. CPG 234 is not itself enforceable. It sets out APRA’s view of sound practice and provides guidance on how entities may approach the binding requirements in CPS 234.
CPS 234 also works alongside CPS 230 Operational Risk Management, which covers operational risk, business continuity and the management of material service providers. CPS 230 commenced on 1 July 2025, with an amended version taking effect on 1 July 2026.
What does CPS 234 require?
The requirements can be grouped into five areas. The paragraph references below are included because that is how an auditor or reviewer is likely to refer to them.
Roles and responsibilities (paragraphs 13–14)
The board is ultimately responsible for the entity’s information security. Roles and responsibilities must be clearly defined across the board, senior management, governing bodies and the individuals responsible for decision-making, approval, oversight and operations.
Typical evidence may include documented accountabilities, committee charters, reporting and escalation arrangements, board papers and minutes showing that security risks and control performance are being considered and challenged.
In June 2025, following credential-stuffing attacks in the superannuation sector, APRA required RSE licensees to identify the Financial Accountability Regime accountable person or people responsible for CPS 234 compliance. While that direction was specific to RSE licensees, every regulated entity should be able to show who is accountable for each part of its information security obligations.
Information security capability and controls (paragraphs 15–17 and 20–22)
Entities must maintain information security capability commensurate with the size and extent of threats to their information assets and keep that capability current as vulnerabilities, threats and the business environment change.
Information assets, including those managed by third parties, must be classified by criticality and sensitivity. Controls must then be proportionate to the asset’s vulnerabilities, threats, criticality, sensitivity, life-cycle stage and the potential consequences of an incident.
Strong evidence may include:
- a current assessment of vulnerabilities and threats;
- a complete and maintained information asset register;
- documented criticality and sensitivity classifications;
- controls mapped to relevant information assets and risks; and
- records showing that control gaps are identified, risk-assessed and remediated.
Information security policy framework (paragraphs 18–19)
Entities must maintain an information security policy framework that is commensurate with their exposure to vulnerabilities and threats. It must provide direction to everyone with an obligation to maintain information security, including staff, contractors, consultants and relevant third parties.
Typical evidence includes policies, standards and procedures with clear owners and review dates, records showing that relevant people have received or acknowledged them, and a controlled process for approving and reviewing exceptions. An exceptions register is sound practice, although CPS 234 does not prescribe a particular format.
Incident management and APRA notification (paragraphs 23–26 and 35–36)
Entities must have robust mechanisms to detect and respond to information security incidents in a timely manner. They must maintain response plans for incidents that could plausibly occur and review and test those plans at least annually.
APRA must be notified as soon as possible and no later than 72 hours after an entity becomes aware of an information security incident that:
- materially affected, or had the potential to materially affect, the entity or the interests of depositors, policyholders, beneficiaries or other customers; or
- has been notified to another regulator in Australia or another jurisdiction.
The 72-hour period is measured in elapsed hours, so weekends and public holidays do not stop the clock. APRA’s guidance also makes clear that entities should notify as soon as possible, even where complete information about the incident or response is not yet available.
A material information security control weakness must be reported as soon as possible and no later than 10 business days after the entity becomes aware of it where the entity expects it will not be able to remediate the weakness in a timely manner.
Evidence should include tested response plans, exercise reports, tracked remediation actions, escalation paths and documented criteria for deciding whether an incident or control weakness is material and reportable.
Control testing and internal audit (paragraphs 27–34)
CPS 234 requires a systematic testing program for information security controls. The nature and frequency of testing must reflect factors including how quickly vulnerabilities and threats change, the criticality and sensitivity of the information assets, the consequences of an incident and the frequency of change.
Testing must be performed by appropriately skilled and functionally independent specialists. The sufficiency of the testing program must be reviewed at least annually and whenever there is a material change to information assets or the business environment.
Internal audit must review the design and operating effectiveness of information security controls, including controls maintained by related parties and third parties. Where internal audit intends to rely on assurance provided by a third party and an incident affecting the relevant assets could have a material impact, it must assess the quality of that assurance.
What does CPS 234 mean for your information security and IT environment?
A CPS 234 review turns the principles in the standard into practical questions about how information assets are governed, protected, monitored and tested.
Access controls and identity
Privileged access, remote access and high-risk transactions require particular scrutiny. Following the 2025 credential-stuffing attacks, APRA told RSE licensees that, at a minimum, it expected multi-factor authentication or equivalent controls for administrative and privileged access and for high-risk member activities such as withdrawals, transfers and changes to member details.
Although that direction was issued to superannuation trustees, CPG 234 has long identified multi-factor authentication as sound practice for privileged access, remote access and other high-risk activities.
Vulnerability, configuration and patch management
CPS 234 does not prescribe a fixed patching timeframe. It requires controls to be implemented in a timely manner and maintained as vulnerabilities and threats change.
Evidence may include vulnerability scan results, secure configuration standards, patch reporting measured against risk-based internal timeframes, documented exceptions and proof that high-risk findings are escalated and remediated.
APRA’s more recent supervisory findings have specifically highlighted weaknesses in secure configuration, privileged access management and the coverage and oversight of security testing.
Third-party and supply-chain risk
Using a managed service provider, cloud platform or SaaS vendor does not transfer the regulated entity’s accountability.
Entities need to understand which information assets are managed by each provider, assess the provider’s capability, evaluate relevant control design and obtain evidence about operating effectiveness. Where the entity relies on a provider’s control testing, it must assess whether the nature and frequency of that testing are appropriate.
Contracts should support these obligations through clear security responsibilities, incident-notification and escalation requirements, access to assurance evidence, audit rights and cooperation with regulatory obligations. These are important mechanisms for meeting CPS 234 and CPS 230 obligations, even though CPS 234 does not prescribe a single contractual form.
Incident detection and response
The 72-hour notification clock starts when the entity becomes aware of a reportable incident, not once an investigation is complete.
If the people responsible for assessing materiality, coordinating the response and notifying APRA only operate during business hours, an incident detected on a Friday evening can quickly expose a gap. Materiality criteria, decision-making authority, contact details and notification processes should therefore be documented, exercised and available outside normal hours.
Documentation and audit trail
Appropriate audit logs, change records, access-review evidence, testing results and remediation records turn control activity into evidence. Records should be retained and accessible for internal assurance, independent review and regulatory requests.
Documentation does not replace an effective control, but without reliable evidence an entity may be unable to demonstrate that the control was operating when required.
What has APRA found through its CPS 234 assessments?
APRA’s CPS 234 tripartite assessment program required regulated entities to appoint an independent auditor to assess compliance with the standard.
In July 2023, APRA published findings from the first tranche, which covered around 24 per cent of regulated entities. It identified six common gaps:
- incomplete identification and classification of critical and sensitive information assets;
- limited assessment of third-party information security capability;
- inadequate definition and execution of control testing programs;
- incident response plans not regularly reviewed or tested;
- limited internal audit review of information security controls; and
- inconsistent and untimely reporting of material incidents and control weaknesses to APRA.
Those findings were not simply documentation issues. They included controls, testing and assurance processes that were incomplete, inconsistently executed or not operating effectively.
APRA later highlighted additional weaknesses in backup isolation and recovery testing, secure configuration, privileged access management and security-testing coverage. After the tripartite program concluded in 2024, APRA said the completed assessments had revealed sector-wide deficiencies and that further uplift was still required.
In April 2026, APRA also called for a step-change in the management of AI-related risks. It warned that governance, assurance and operational resilience were not keeping pace with AI adoption and reinforced the need for effective oversight of third-party dependencies, cyber hygiene, patching and vulnerability remediation.
The direction is clear: APRA expects entities to continually reassess whether their information security capability remains appropriate as technology, threats and business dependencies change.
How does APRA assess CPS 234 compliance?
APRA can seek evidence of compliance through ongoing supervision, thematic reviews, independent assessments and incident or breach reporting. Its focus is not limited to whether policies exist. It considers whether required controls are appropriately designed, operating effectively and supported by credible testing and assurance.
CPS 234 does not specify a numerical pass mark. It is outcomes-based, and compliance depends on the entity’s circumstances, risk profile and ability to demonstrate that the requirements are being met.
As Kristof Kazmer puts it:
“CPS 234 isn’t about a document or policy you can refer to. If you can’t demonstrate the control exists and works, you can’t rely on it.”
The time it takes to produce evidence can be a useful warning sign. If finding the owner, test result or approval for a control takes days, the evidence process needs attention. However, remediation must still be prioritised by risk, criticality and materiality, not by documentation effort alone.
How do you meet your CPS 234 obligations?
Start with a gap assessment against each requirement in the standard. Map existing controls to the relevant paragraphs and identify the evidence demonstrating both design and operating effectiveness.
Gaps generally fall into three categories:
- documentation or evidence that is missing, incomplete or out of date;
- technical or operational controls that need to be implemented or improved; and
- governance and assurance processes that are not clearly owned, independently tested or performed on a reliable schedule.
Prioritise remediation using the criticality and sensitivity of the affected assets, the potential consequences of an incident and whether the issue could represent a material control weakness. The ability to identify, escalate and notify reportable incidents within the required timeframe should also be tested.
Evidence collection should then be built into normal operations. Monitoring, access reviews, vulnerability management, patching, incident exercises, control testing and remediation should produce reliable records as part of the process, not only when an auditor or APRA asks for them.
CPS 234 does not mandate specific technologies. Existing platforms can often be configured, integrated and managed more effectively before an organisation considers replacing them. A managed service provider with information security compliance expertise can help design, operate and evidence these controls while working alongside the entity’s risk, compliance and internal audit functions.
Where an organisation also owns or operates assets captured by the SOCI Act, those obligations sit alongside CPS 234. Our SOCI compliance page explains how those requirements work.
Where to start with APRA CPS 234 compliance
Select a critical information asset and trace it through the standard:
- Is it recorded and correctly classified?
- Are the threats, vulnerabilities and potential consequences understood?
- Are appropriate controls mapped to it?
- Have those controls been independently tested?
- Are deficiencies tracked and escalated?
- Can the evidence be produced quickly?
- Is there a tested response and notification process if those controls fail?
This provides a more realistic view of your CPS 234 position than reviewing policies in isolation.
ASE Tech is ISO 27001 certified and independently audited. As an ACMA-licensed carrier, we also operate under telecommunications and critical-infrastructure security obligations, so we understand the practical burden of maintaining controls, testing their effectiveness and producing regulatory evidence.
We work with APRA-regulated organisations to assess and improve their CPS 234 compliance position, from an initial gap assessment through to remediation and ongoing managed compliance support. Our cybersecurity services support the operation of security controls, while our IT compliance services support assessment, governance and evidence.
