APRA CPS 234: What Australian Financial Services Firms Need to Know

If your organisation is regulated by the Australian Prudential Regulation Authority (APRA) - a bank, insurer, superannuation fund, or holder of an Australian Financial Services Licence - then APRA Prudential Standard CPS 234 Information Security is a mandatory compliance requirement, not a guideline.

CPS 234 has been in force since 1 July 2019. Here is what it requires and what organisations typically need to do to meet it.

What is CPS 234?

CPS 234 is a prudential standard that requires APRA-regulated entities to maintain information security capabilities commensurate with the size and extent of threats to their information assets. It covers the entity's own systems and those of any third parties who manage information assets on their behalf.

The standard is designed to minimise the likelihood and impact of information security incidents affecting the confidentiality, integrity or availability of information assets.

Who does it apply to?

CPS 234 applies to all APRA-regulated entities, including:

• Authorised deposit-taking institutions (banks, credit unions, building societies)
• General, life and private health insurers
• Superannuation funds and trustees
• Registered financial corporations

Importantly, the standard also extends obligations to third-party service providers that manage information assets on behalf of regulated entities. This means vendors and outsourced providers handling sensitive data are directly in scope.

Key requirements

CPS 234 sets out obligations across five areas:

1. Roles and responsibilities

Boards must ensure information security capability is clearly defined. Accountability for CPS 234 compliance sits at the board level, not just with the security or IT team. The board must be satisfied that the entity maintains adequate information security practices.

2. Information security capability

Entities must maintain an information security capability commensurate with the size and complexity of their operations and the threats they face. This capability must be reviewed regularly and updated as threats evolve.

3. Policy framework

A documented information security policy framework must be in place, covering controls appropriate to the entity's risk profile. This framework must be reviewed at least annually or following significant change.

4. Control implementation and testing

Information security controls must be implemented and tested regularly. Testing must be conducted by qualified, independent assessors. The frequency and rigour of testing must reflect the criticality of the systems involved.

5. Incident management and notification

Entities must notify APRA within 72 hours of becoming aware of a material information security incident, or an incident notified to another regulator. APRA must also be notified within 10 business days if a control weakness is identified that cannot be remediated in a timely manner.

Where organisations typically struggle

In APRA's own assessments, common gaps include inadequate testing of third-party controls, inconsistent application of the policy framework across subsidiaries, and board-level reporting that lacks the detail needed for informed oversight.

Third-party risk is particularly challenging. Many entities lack a clear view of what information assets their service providers hold and what controls are in place to protect them.

How a cybersecurity vendor can help

Specialised cybersecurity firms assist APRA-regulated entities with CPS 234 gap assessments, policy framework development, control testing, and board-level reporting. For the independent testing requirement, the assessor must be sufficiently skilled and free from conflicts of interest - this typically means an external firm rather than internal resources.

Find CPS 234-experienced providers on CyberAtlas

CyberAtlas lists Australian cybersecurity firms with financial services and compliance experience. Use the directory to find providers who have worked with APRA-regulated entities and understand CPS 234 requirements.