APRA CPS 230 compliance requirements are no longer a future planning exercise. Since CPS 230 came into force on 1 July 2025, Australian Prudential Regulation Authority (APRA) reviews have increasingly incorporated operational resilience into prudential supervision activities. The most dangerous misconception circulating among Australian financial institutions is that compliance with CPS 234 automatically satisfies CPS 230 obligations. It does not.
CPS 234 focuses on information security. CPS 230 focuses on operational resilience. While the two standards intersect, they are designed to address different risks and require different evidence. An institution may have mature cyber security controls, extensive security monitoring, and well-documented incident response procedures, yet still fall short of CPS 230 expectations.
The gap exists because CPS 230 shifts the conversation away from protecting technology assets and toward maintaining critical business operations during severe disruptions. It requires organisations to identify which operations are essential, understand the technology and third-party dependencies supporting those operations, define acceptable disruption thresholds, and demonstrate resilience through testing and governance.
For many Australian banks, insurers, and superannuation funds, these requirements represent a significant expansion of existing risk and compliance programmes.
CPS 230 and CPS 234: Why Managing Them as Separate Workstreams Is a Compliance Risk
Many organisations view CPS 230 and CPS 234 as distinct regulatory projects. From a governance perspective they are separate standards. From an operational perspective they are deeply connected.
CPS 234 establishes requirements for protecting information assets, maintaining security controls, testing effectiveness, and responding to information security incidents. Its focus is preventing and managing cyber security events.
CPS 230 addresses operational resilience. The focus is ensuring critical business services remain available despite disruptions, regardless of whether those disruptions originate from cyber incidents, technology failures, human error, natural disasters, or third-party service outages.
This distinction matters because CPS 230 introduces obligations that do not exist within CPS 234.
These include:
- Identification and documentation of critical operations
- Establishment of disruption tolerance levels
- Assessment and oversight of material service providers
- Operational resilience testing and validation
- Board oversight of resilience capabilities
An institution that has achieved strong CPS 234 maturity may still have significant CPS 230 gaps because information security controls alone do not demonstrate operational resilience.
For example, a bank may operate an advanced Security Operations Centre, conduct regular penetration testing, and maintain a mature vulnerability management programme. However, if it cannot demonstrate which business operations are critical, define acceptable disruption thresholds, or show how third-party dependencies affect those operations, APRA may still identify CPS 230 deficiencies.
The risk is that organisations treat cyber security and operational resilience as separate assurance streams when APRA increasingly expects them to function as an integrated capability.
What is APRA CPS 230 and when did it come into effect?
APRA Prudential Standard CPS 230 Operational Risk Management is a prudential standard issued by the Australian Prudential Regulation Authority that requires regulated entities to identify their critical operations, set tolerance levels for disruption, and maintain oversight of material service providers. CPS 230 came into force on 1 July 2025 for most APRA-regulated entities. It sits alongside CPS 234, which covers information security, as part of APRA’s broader operational resilience framework.
The Three CPS 230 Obligations Where Most Institutions Have Active Gaps
While implementation maturity varies across the sector, three obligations consistently emerge as areas where organisations struggle to demonstrate compliance.
1. Critical Operations Mapping
Critical operations mapping is one of the most misunderstood components of CPS 230.
Most financial institutions already maintain extensive inventories of systems, applications, data assets, infrastructure platforms, and third-party suppliers. However, CPS 230 requires organisations to move beyond technology inventories and focus on business outcomes.
A critical operation is not a system.
A critical operation is a business function whose disruption would materially affect customers, financial stability, regulatory obligations, or the organisation’s ability to operate.
Examples may include:
- Retail payment processing
- Claims management
- Investment transaction processing
- Customer account access
- Superannuation administration
Once identified, organisations must map every dependency supporting those operations.
This includes:
- Applications and infrastructure
- Data repositories
- Internal operational teams
- Cloud platforms
- Telecommunications providers
- Outsourced service providers
- Recovery arrangements
The challenge is that many institutions approach this exercise from a technology perspective rather than an operational perspective.
A technology dependency map may show application relationships. APRA is looking for evidence that the organisation understands how disruption affects business operations and customers.
A reviewer asking about payment processing resilience is unlikely to be satisfied with a network diagram. They want to understand the operational consequences of service disruption, the dependencies involved, and the controls available to maintain continuity.
2. Tolerance Levels for Disruption
CPS 230 requires organisations to define tolerance levels for each critical operation.
Tolerance levels represent the maximum level of disruption an organisation can sustain before material harm occurs.
This obligation extends beyond traditional disaster recovery metrics such as Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
Tolerance levels must be linked directly to customer impact, regulatory obligations, operational capability, and financial stability considerations.
For example, an institution may determine that customer payment processing cannot be disrupted beyond a defined period without creating unacceptable customer harm.
The Board must approve these tolerance levels and review them annually.
More importantly, organisations must demonstrate that tolerance levels are realistic.
This is where many institutions encounter difficulties.
Tolerance levels frequently exist within policies and governance documentation but have not been validated through testing.
APRA’s supervisory approach increasingly focuses on whether resilience assumptions can withstand realistic disruption scenarios.
Questions reviewers may ask include:
- Has the tolerance level been tested?
- When was it last validated?
- What scenario was used?
- What evidence demonstrates the operation can recover within tolerance?
Without testing evidence, tolerance levels become theoretical statements rather than defensible resilience measures.
3. Material Service Provider Register and Assessment
Third-party dependency risk sits at the centre of CPS 230.
Financial institutions increasingly rely on cloud providers, managed service providers, software vendors, telecommunications operators, and outsourced business process providers.
APRA recognises that operational resilience cannot be assessed without understanding these dependencies.
CPS 230 therefore requires organisations to maintain a current register of material service providers and assess their resilience capabilities.
Importantly, accountability remains with the regulated entity.
The non-delegable obligation principle means responsibility cannot be transferred to a supplier.
If a cloud provider experiences a major outage affecting a critical operation, APRA will expect the regulated entity to demonstrate:
- Understanding of the dependency
- Assessment of associated risks
- Appropriate resilience controls
- Effective governance and oversight
A common weakness is reliance on vendor questionnaires as the primary assessment mechanism.
Questionnaires may provide useful information, but they rarely provide sufficient assurance on their own.
Increasingly, organisations are supplementing questionnaires with independent assessments, resilience testing reviews, contract evaluations, and evidence-based assurance activities.
What APRA Is Actually Looking for in a Prudential Review
APRA’s supervisory model is increasingly focused on operational effectiveness rather than policy existence.
Historically, many compliance reviews emphasised documentation. Organisations could demonstrate compliance through policies, frameworks, and governance artefacts.
That expectation has shifted.
Under CPS 230, reviewers increasingly seek evidence that controls function under realistic operating conditions.
Institutions should expect requests for:
- Critical operations inventories
- Dependency mapping documentation
- Board-approved tolerance levels
- Resilience testing results
- Service provider registers
- Independent assessment records
- Escalation procedures
- Operational incident reporting workflows
Reviewers are also assessing consistency.
If tolerance levels are documented in one governance artefact but operational teams apply different assumptions in practice, this inconsistency may generate findings.
Similarly, if resilience testing identifies recovery times exceeding documented tolerance levels, institutions must demonstrate remediation activities.
APRA’s Prudential Practice Guide CPG 230 provides important guidance regarding supervisory expectations and should be considered a foundational reference document for implementation programmes.
The underlying question reviewers increasingly ask is simple:
Can the organisation prove that critical operations remain resilient during disruption?
Policies contribute to that answer, but evidence provides the proof.
Building a Unified CPS 234 and CPS 230 Compliance Programme
The most efficient implementation strategy is integration rather than duplication.
Many of the capabilities required under CPS 230 already exist within mature CPS 234 programmes.
Asset inventories support dependency mapping.
Threat modelling informs operational risk analysis.
Incident response exercises provide resilience validation opportunities.
Recovery testing demonstrates operational continuity performance.
A well-designed tabletop exercise can simultaneously evaluate multiple compliance obligations.
For example, a ransomware simulation can assess:
- CPS 234 detection capabilities
- CPS 234 notification procedures
- CPS 230 operational disruption impacts
- CPS 230 tolerance level performance
- Executive decision-making processes
- Recovery effectiveness
This creates efficiencies across assurance activities while generating stronger evidence for both standards.
Organisations that have completed previous CPS 234 uplift programmes should use that work as the foundation for operational resilience activities rather than creating entirely separate projects.
Many institutions are also aligning governance structures to create integrated resilience programmes covering cyber security, operational risk, business continuity, third-party risk management, and incident response.
Organisations seeking assistance with APRA CPS 234 and CPS 230 compliance services often find the greatest value comes from integrating existing cyber security investments into a broader resilience framework.
Similarly, incident response planning aligned to APRA timelines should be designed not only to satisfy cyber security obligations but also to validate operational resilience assumptions and recovery capabilities.
The institutions making the fastest progress are typically those building upon existing maturity rather than creating parallel compliance programmes.
Conclusion
APRA is not waiting for institutions to self-assess readiness. CPS 230 is already embedded within supervisory activity, and operational resilience evidence is becoming a standard component of prudential reviews.
The organisations most likely to avoid remediation findings are those that have completed critical operations mapping, validated tolerance levels through realistic disruption testing, and maintain a current service provider assessment register supported by evidence rather than assumptions.
Operational resilience is no longer viewed as a business continuity exercise performed in isolation. It is increasingly becoming a measurable capability that regulators expect organisations to demonstrate.
Institutions preparing for future supervisory reviews should consider undertaking a formal security risk assessment to identify resilience gaps before APRA does. The objective is not simply to produce documentation. It is to generate evidence that critical operations can continue when disruption inevitably occurs.
Frequently Asked Questions
What is the difference between APRA CPS 230 and CPS 234?
CPS 234 governs information security, including protection of information assets, security testing, and incident response. CPS 230 governs operational resilience, including critical operations identification, disruption tolerance levels, and service provider management. While related, they are separate prudential obligations.
When did APRA CPS 230 come into effect in Australia?
CPS 230 came into force on 1 July 2025 for most APRA-regulated entities, including banks, insurers, and superannuation trustees.
What does CPS 230 require for service provider management?
CPS 230 requires regulated entities to maintain a register of material service providers and independently assess their operational resilience capability. Organisations remain accountable for resilience outcomes even when services are outsourced.
How do tolerance levels work under CPS 230?
Tolerance levels define the maximum duration and extent of disruption an organisation can sustain before material harm occurs. They must be documented, Board-approved, reviewed annually, and validated through realistic testing activities.
Strengthening APRA CPS 230 Compliance with Intrix
Intrix helps Australian financial institutions strengthen operational resilience and meet evolving regulatory obligations under CPS 230 and CPS 234. Our specialists work with banks, insurers, superannuation funds, and other APRA-regulated entities to identify compliance gaps, assess critical operations, validate disruption tolerance levels, and improve service provider oversight.
Our approach goes beyond documentation. We help organisations demonstrate resilience in practice through critical operations mapping, operational risk assessments, resilience testing, incident response planning, and independent assurance activities. By aligning cyber security, operational risk, and compliance programmes, we help organisations build evidence that stands up to APRA scrutiny.
Preparing for an upcoming prudential review or CPS 230 readiness assessment? Contact Intrix today to discuss how our APRA compliance, security risk assessment, and operational resilience services can help your organisation identify gaps, strengthen controls, and demonstrate compliance with confidence.
