APRA CPS 234 for APRA-regulated entities in Australia
APRA CPS 234: information security obligations and how to evidence them
Who CPS 234 binds, what the board is accountable for, how third parties and testing are treated, the 72-hour and 10-business-day notifications to APRA, and where CPS 230 fits.
In short
CPS 234 is APRA's prudential standard on information security. It has applied since 1 July 2019 to every APRA-regulated entity, including ADIs, insurers and RSE licensees. The board is accountable for information security. The entity must keep its security capability in line with the threats it faces, assess the related and third parties that manage its information assets, test its controls, have internal audit review them, and notify APRA within set timeframes. Since 1 July 2025 it has applied alongside CPS 230 on operational risk management.
Who CPS 234 applies to
CPS 234 applies to all APRA-regulated entities, including authorised deposit-taking institutions, insurers and registrable superannuation entity (RSE) licensees. It is a prudential standard and is legally binding.
If you supply services to an APRA-regulated entity, CPS 234 reaches you indirectly. Your customer must assess the information security capability of the third parties that manage its information assets. Expect that assessment to arrive as questionnaires, evidence requests and contract terms.
- APRA-regulated entity
- An entity supervised by APRA, such as an authorised deposit-taking institution (ADI), an insurer or an RSE licensee.
- Information asset
- The information and technology the standard protects. Read the definition in CPS 234 itself when scoping.
What CPS 234 requires
CPS 234 is a short standard and every obligation in it is binding. APRA will want to see each one operating, so plan the evidence at the same time as the policy.
- Board accountability. The board is ultimately responsible for the entity's information security.
- Capability commensurate with threats. Maintain information security capability commensurate with the threats to the entity's information assets.
- Related and third parties. Assess the information security capability of related and third parties that manage the entity's information assets.
- Systematic testing. Test the effectiveness of information security controls through a systematic testing programme, carried out by functionally independent specialists. Review the testing programme at least annually.
- Internal audit. Internal audit reviews the design and operating effectiveness of information security controls.
- Notification. Notify APRA of material information security incidents, and of material control weaknesses that cannot be remediated in a timely way.
Notification deadlines
CPS 234 sets two notification duties. Each clock starts when the entity becomes aware of the incident or identifies the weakness. Detection and escalation routes therefore matter as much as the reporting template.
| Event | Deadline | Notes |
|---|---|---|
| Material information security incident | As soon as possible, no later than 72 hours after becoming aware | The entity judges materiality. Agree the criteria in advance. |
| Material control weakness | No later than 10 business days after identifying it | Where the weakness cannot be remediated in a timely manner |
The 2018 draft of CPS 234 proposed shorter deadlines of 24 hours and 5 days. The final standard uses 72 hours and 10 business days.
CPS 230: operational risk management alongside CPS 234
CPS 230 Operational Risk Management commenced on 1 July 2025. It does not replace CPS 234, and both apply. CPS 230 covers operational risk, business continuity and the management of service providers. It overlaps with CPS 234 wherever an information security incident is also an operational disruption.
| CPS 230 event | Deadline |
|---|---|
| Material operational risk incident | Within 72 hours of becoming aware |
| Disruption to a critical operation outside tolerance | Within 24 hours |
Where an event triggers notification under both standards, APRA's guidance in CPG 230 says the shorter timeframe applies. An incident that disrupts a critical operation beyond tolerance is therefore a 24-hour notification, even if it is also a CPS 234 incident.
How CPS 234 relates to ISO 27001 and the Essential Eight
CPS 234 states outcomes and accountabilities. It has no control catalogue of its own. Many entities use ISO 27001 or the ACSC Essential Eight to structure the controls behind those outcomes. We are not aware of an official APRA mapping to either, so confirm any overlap control by control.
The parts CPS 234 adds are prudential: board accountability, the assessment of third-party capability, independent testing, internal audit and the APRA notifications. Map those explicitly. An ISO 27001 certificate does not cover them on its own.
Building a CPS 234 programme
Start with your information assets and the third parties that manage them. The rest of CPS 234 is measured against them.
-
01
Classify information assets
Identify information assets, including those managed by related and third parties, and classify them by criticality and sensitivity.
Your CISO and asset owners
-
02
Map controls to CPS 234
Map the standard's requirements to the controls you already run and record the gaps.
Your security and risk teams
-
03
Assess third parties
Assess the information security capability of each third party that manages your information assets, in proportion to the assets involved.
Your vendor management team
-
04
Run independent testing
Test control effectiveness through functionally independent specialists, and review the testing programme at least annually.
Your security team and independent testers
-
05
Prepare the notification routes
Agree who decides materiality and how APRA is notified within 72 hours, 10 business days, or 24 hours where CPS 230 applies.
Your incident, risk and compliance teams
Who does what
APRA supervises, and the board is accountable for information security. Certifyi is a tool and does not notify APRA on your behalf.
| Task | Your team | Certifyi | APRA |
|---|---|---|---|
| Board accountability | The board is ultimately responsible | Records management reviews | Supervises the entity |
| Third-party capability | Assess third parties that manage information assets | Holds vendor assessments and questionnaire responses | Reviews during supervision |
| Control testing | Systematic testing by independent specialists | Holds test reports as evidence against each control | Reviews the testing programme |
| Internal audit | Review design and operating effectiveness | Gives auditors scoped, read-only access to evidence | Relies on audit findings |
| Notification | Notify within 72 hours or 10 business days | Keeps the incident record and its timeline | Receives notifications |
How Certifyi helps
Evidence CPS 234 from the controls you already run
Certifyi does not make you compliant with CPS 234. It is a workspace for your controls, the third parties behind them, and the evidence APRA and your auditors ask for.
-
Third-party assessments
Assess the vendors that manage your information assets in third-party risk management. Vendors answer your questionnaires in their own portal, not by email.
-
Access for internal audit
Give internal or external auditors scoped, read-only access to the evidence for their engagement.
-
Management reviews
Record management reviews of the information security programme in the same workspace as the controls and evidence.
Questions
CPS 234, answered
Who must comply with CPS 234?
All APRA-regulated entities, including authorised deposit-taking institutions, insurers and registrable superannuation entity licensees.
How quickly must a material incident be reported to APRA?
As soon as possible, and no later than 72 hours after becoming aware of a material information security incident.
What is the deadline for reporting a control weakness?
No later than 10 business days after identifying a material information security control weakness that cannot be remediated in a timely manner.
Does CPS 230 replace CPS 234?
No. Both apply. CPS 230, in force since 1 July 2025, covers operational risk, business continuity and service providers. Where an event triggers notification under both, the shorter timeframe applies.
Does CPS 234 apply to our suppliers?
Not directly. The entity must assess the information security capability of related and third parties that manage its information assets, so suppliers should expect assessments and contract terms.
Is there a CPS 234 certification?
No. APRA supervises compliance and issues no certificate. Evidence comes from internal audit, independent testing and supervisory review.
Does Certifyi make us compliant with CPS 234?
No. Compliance depends on board oversight, controls, testing and notification that are yours to run. Certifyi gives you a workspace to record that work and keep the evidence.
Talk through CPS 234 in a 30-minute call.
Bring your list of information assets and the third parties that manage them. We will show how your vendor assessments and testing evidence sit together in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them