Compliance · APRA CPS 234
CPS 234 compliance, without the scramble.
CPS 234 is APRA's information security standard, and it applies with equal force to the smallest regulated entity and the service providers holding their data. Here is what it requires, and how to close the gap with evidence rather than assurances.
IronSights runs CPS 234 gap assessments, independent control testing, and the ongoing monitoring that turns the 72-hour notification clock from a threat into a procedure.
The standard
What is CPS 234?
CPS 234 is the information security standard set by the Australian Prudential Regulation Authority (APRA). It requires the entities APRA regulates to protect the confidentiality, integrity, and availability of their information assets, and to be able to prove those protections actually work.
It has been in force since 1 July 2019, and it carries the same weight for a boutique insurer as it does for a major bank. Its obligations also reach the financial services providers that hold regulated data on a client's behalf, and it sits within a widening set of Australian cyber rules such as the Cyber Security Act 2024. The sections below cover who it captures, the eight obligations it sets, and what it takes to meet them.
Who it applies to
Wider than most businesses assume.
APRA-regulated entities
Banks and ADIs, general, life, and private health insurers, and RSE licensees (superannuation trustees), of every size, not just the majors.
Smaller regulated entities
CPS 234 has no small-entity carve-out. A boutique insurer or small super trustee carries the same obligations as a big four bank, with a fraction of the security headcount.
Service providers to regulated entities
If a regulated entity's information assets sit with you (as their administrator, software provider, adviser network, or outsourced back office), their CPS 234 obligations reach into your environment through contract and assurance requests.
The obligations
What CPS 234 requires.
Eight obligations, from board accountability through to the 72-hour incident notification. For the full plain-English walkthrough, read our CPS 234 explainer.
Board accountability
The board is ultimately responsible for information security. 'IT handles that' is not an acceptable answer to APRA.
Security capability
Your security capability must match the size and extent of the threats to your information assets, and keep pace as they change.
Policy framework
A maintained information security policy framework, proportionate to your exposures, covering staff and third parties.
Asset classification
Information assets identified and classified by criticality and sensitivity, including the ones your vendors hold.
Controls implementation
Controls in place to protect assets, commensurate with the threats, tested through their lifecycle.
Systematic testing
Controls tested on a systematic schedule by functionally independent, appropriately skilled testers.
Internal audit
Internal audit must review the design and operating effectiveness of controls, including those run by third parties.
Incident notification
Material incidents notified to APRA within 72 hours. Material control weaknesses within 10 business days.
How we help
From gap assessment to standing evidence.
Built for the smaller regulated entities and service providers that carry big-bank obligations without big-bank security teams. Where CPS 234 calls for named security accountability, a virtual CISO gives you that leadership without a full-time hire.
CPS 234 gap assessment
Every obligation in the standard mapped against your current state, with a prioritised remediation plan the board can read.
Control testing
The systematic, independent testing the standard requires: penetration testing and control validation, mapped back to CPS 234 clauses.
Incident readiness
A response plan that meets the 72-hour notification clock, tested before you need it. Incident response support when something happens.
Ongoing assurance
Managed security with monthly board-ready reporting, so the evidence APRA and your auditors ask for already exists.
Common questions
CPS 234, in plain terms.
Working through an APRA request or a client questionnaire right now? Talk to us , we've answered most of them before.
What is CPS 234?
CPS 234 Information Security is a prudential standard issued by the Australian Prudential Regulation Authority (APRA), in force since 1 July 2019. It requires APRA-regulated entities to maintain an information security capability commensurate with their threats, classify their information assets, implement and systematically test controls, and notify APRA of material incidents within 72 hours.
When did CPS 234 come into effect?
CPS 234 has been in force since 1 July 2019. Where a regulated entity's information assets are managed by a third party, the standard allowed until 1 July 2020 for those arrangements to be brought into line at the next contract renewal. It has applied in full ever since, and APRA has steadily raised its expectations of the evidence entities can produce.
What are the CPS 234 requirements?
The standard sets eight obligations. The board holds ultimate accountability for information security. You must maintain a security capability matched to your threats, a documented policy framework, and a classification of your information assets by sensitivity and criticality. Controls must be implemented in proportion to those threats, tested systematically by independent and skilled testers, and reviewed by internal audit. Material incidents must be notified to APRA within 72 hours, and material control weaknesses within 10 business days.
Who does CPS 234 apply to?
All APRA-regulated entities: authorised deposit-taking institutions, general insurers, life insurers, private health insurers, and RSE licensees in superannuation. There is no exemption for smaller entities. Its reach also extends practically to third parties that manage information assets on a regulated entity's behalf, because the entity must assess and rely on those parties' controls.
We're a service provider to a bank or super fund, not APRA-regulated. Does CPS 234 affect us?
Yes, contractually. Regulated entities must evaluate the information security of parties that hold their assets, so their obligations arrive in your inbox as security questionnaires, audit clauses, control attestations, and incident notification requirements. Being able to demonstrate tested controls is increasingly the price of keeping those contracts.
What has to be reported to APRA, and how fast?
Two things. Material information security incidents must be notified within 72 hours of becoming aware, including incidents at your third parties. Material control weaknesses that cannot be remediated in a timely way must be notified within 10 business days of identification. Both timeframes assume you have the detection capability to know in the first place.
How does CPS 230 relate to CPS 234?
CPS 230 Operational Risk Management commenced on 1 July 2025 and sits alongside CPS 234. CPS 230 governs operational resilience and service provider management broadly; CPS 234 remains the specific information security standard. In practice the two overlap heavily on third-party risk, and uplift work should satisfy both rather than treating them as separate projects.
What does a CPS 234 gap assessment involve?
We map every obligation in the standard, governance, capability, policy, classification, controls, testing, audit, and notification, against your current state, with evidence. You get a board-ready report showing where you stand, what needs to change, and in what order. For most smaller regulated entities it takes two to four weeks.
First step
Know where you stand before APRA asks.
A CPS 234 gap assessment in two to four weeks: every obligation mapped, evidence gathered, and a board-ready remediation plan.