APRA CPS 230 is the prudential standard on operational risk management for APRA-regulated entities, in effect from 1 July 2025. It requires organisations to manage operational risk, maintain critical operations through disruptions, and oversee the risks of material service providers. For cyber teams, that means tested resilience, third-party assurance and clear incident management.
What Is CPS 230 and Who Does It Apply To?
Operational resilience has become a strategic priority for financial institutions across Australia.
Rather than focusing solely on preventing disruptions, regulators increasingly expect organisations to demonstrate that they can continue delivering critical services during cyber attacks, technology failures and third-party disruptions.
This is the purpose of APRA Prudential Standard CPS 230 Operational Risk Management.
Effective from 1 July 2025, CPS 230 establishes minimum requirements for managing operational risk, maintaining critical operations and overseeing material service providers. It replaces the previous outsourcing and business continuity standards by bringing these requirements together under a single operational resilience framework. APRA also introduced targeted amendments from 1 July 2026 for certain contractual arrangements involving specific categories of service providers. You can read the full APRA Prudential Standard CPS 230 Operational Risk Management here: https://www.apra.gov.au/prudential-standard-cps-230-operational-risk-management.
The standard applies to APRA-regulated entities, including:
- Authorised Deposit-taking Institutions (ADIs)
- Banks
- Credit unions
- Building societies
- General insurers
- Life insurers
- Private health insurers
- Superannuation trustees
Although organisations outside the APRA framework are not directly regulated under CPS 230, many are adopting similar operational resilience practices because customers, partners and regulators increasingly expect stronger governance over operational risk.
At its core, CPS 230 requires organisations to understand which business operations are critical, determine how much disruption those operations can tolerate and ensure they can continue operating during severe but plausible events.
The Core Obligations Under CPS 230
CPS 230 introduces a more structured approach to operational resilience than many organisations have traditionally adopted.
Rather than focusing only on disaster recovery plans, the standard requires organisations to actively identify operational risks, establish governance arrangements and continuously monitor whether critical business services remain resilient.
Key obligations include:
- Identifying critical operations.
- Defining tolerance levels for disruption.
- Maintaining effective operational risk management.
- Developing and testing business continuity plans.
- Monitoring material service providers.
- Establishing governance and board oversight.
- Reviewing operational resilience regularly.
One of the most significant concepts introduced by CPS 230 is the requirement to define critical operations.
These are the services that must continue during a disruption because their failure would significantly affect customers, financial stability or the organisation itself.
Rather than asking, “Can we recover?”, CPS 230 asks a more important question:
How quickly must we recover to avoid unacceptable business impact?
That shift places operational resilience alongside cyber security as an executive responsibility rather than simply an IT function.
How CPS 230 Connects to Cyber Security
Although CPS 230 is broader than cyber security, cyber resilience plays a central role in meeting its objectives.
Cyber attacks remain one of the most likely causes of operational disruption. Ransomware, third-party compromise, cloud outages and identity-based attacks all have the potential to interrupt critical business operations.
This is where CPS 230 and CPS 234 Information Security complement one another.
CPS 234 focuses specifically on protecting information assets through effective information security controls, while CPS 230 focuses on ensuring organisations continue operating when those controls fail or when other operational disruptions occur. Together, they help organisations build both preventative security controls and operational resilience.
For many organisations, compliance with CPS 230 will involve reviewing:
- Incident response capabilities.
- Business continuity planning.
- Disaster recovery procedures.
- Crisis management.
- Operational resilience testing.
- Executive decision-making during incidents.
Rather than treating cyber incidents as isolated technical events, organisations are expected to demonstrate that they can continue delivering critical services throughout the disruption.
This broader perspective aligns cyber security with business resilience rather than technology alone.
Third-Party and Supply Chain Risk Under CPS 230
One of the most significant changes introduced by CPS 230 is its stronger focus on third-party risk management.
Financial institutions increasingly rely on external providers for cloud hosting, managed services, payment platforms, software-as-a-service applications and business-critical technology. While these providers offer operational benefits, they can also become a source of disruption if they experience cyber incidents, outages or service failures.
CPS 230 makes it clear that organisations remain accountable for the resilience of their critical operations, even when those operations rely on external providers.
The standard requires organisations to identify material service providers and actively manage the risks they introduce throughout the relationship. This includes assessing providers before engagement, maintaining appropriate contractual arrangements, monitoring ongoing performance and ensuring there are plans in place should a provider experience a significant disruption.
Rather than treating supplier risk as a procurement exercise, CPS 230 embeds third-party oversight into an organisation’s operational risk framework.
For cyber security teams, this reinforces the importance of vendor due diligence, cloud security governance and regular reviews of third-party security controls. As supply chain attacks continue to increase, understanding the cyber resilience of key providers has become just as important as protecting internal systems.
What Good Evidence Looks Like
Meeting CPS 230 requires more than having documented policies and procedures.
APRA expects organisations to demonstrate that operational resilience arrangements are effective in practice. Governance processes should be active, regularly reviewed and supported by evidence showing that resilience plans have been tested under realistic scenarios.
Examples of strong evidence include:
- Clearly documented operational risk management frameworks.
- Defined critical operations and disruption tolerance levels.
- Board-approved business continuity plans.
- Tested incident response and crisis management procedures.
- Records of business continuity exercises.
- Material service provider registers.
- Third-party risk assessments and ongoing reviews.
- Executive reporting on operational resilience.
- Evidence that lessons from incidents and exercises have been incorporated into future planning.
Testing is particularly important.
A business continuity plan that has never been exercised provides little assurance during a real incident. Likewise, incident response plans should be validated through tabletop exercises, technical simulations and post-incident reviews to confirm that people, processes and technology work together effectively.
Operational resilience is not a project completed once. It is an ongoing programme that should continue evolving as the organisation changes.
Practical First Steps Towards Alignment
For many organisations, the biggest challenge is knowing where to begin.
Rather than attempting to implement every requirement simultaneously, organisations should focus on building a structured roadmap that prioritises improvements based on operational risk.
Practical first steps include:
- Identify and document critical business operations.
- Define acceptable disruption tolerance levels.
- Review existing operational risk management processes.
- Assess all material service providers and their associated risks.
- Review business continuity and disaster recovery plans.
- Test incident response and crisis management procedures.
- Evaluate cyber resilience alongside CPS 234 requirements.
- Establish regular executive and board reporting.
- Schedule independent reviews of operational resilience.
Many organisations also benefit from engaging experienced advisers to provide an independent assessment of current governance and cyber maturity.
This is where Virtual CISO Services can provide significant value. A Virtual CISO helps organisations interpret regulatory requirements, establish governance frameworks, improve board reporting and develop practical implementation roadmaps that align with both CPS 230 and broader cyber security objectives.
Independent Security Risk Assessments can also help identify operational and cyber security gaps before they become regulatory or business issues, providing a clear understanding of current maturity and prioritised recommendations for improvement.
Rather than viewing CPS 230 purely as a compliance exercise, organisations should see it as an opportunity to strengthen resilience across people, processes and technology while improving executive confidence in their ability to manage disruption.
Frequently Asked Questions
What is APRA CPS 230?
APRA CPS 230 is a prudential standard governing operational risk management for APRA-regulated entities. Effective from 1 July 2025, it requires organisations to identify critical operations, manage operational risk, oversee material service providers and maintain the ability to continue operating during significant disruptions.
Who does CPS 230 apply to?
CPS 230 applies to APRA-regulated organisations, including banks, authorised deposit-taking institutions, insurers and superannuation trustees. While organisations outside APRA’s supervision are not directly subject to the standard, many are adopting similar operational resilience practices to strengthen governance and customer confidence.
How does CPS 230 relate to CPS 234?
CPS 234 focuses specifically on information security by requiring organisations to protect information assets through appropriate cyber security controls. CPS 230 has a broader focus on operational resilience, ensuring organisations can continue delivering critical services during disruptions, including those caused by cyber incidents.
What does CPS 230 require for third parties?
CPS 230 requires organisations to identify material service providers, understand the risks they introduce, maintain appropriate contractual arrangements and continuously monitor their performance. Even where services are outsourced, organisations remain responsible for ensuring their critical operations remain resilient.
How Intrix Can Help
Achieving compliance with CPS 230 requires more than policies on paper. Organisations need confidence that their governance, cyber security and operational resilience arrangements will perform when tested by real-world disruption.
Intrix’s Virtual CISO Services provide experienced strategic leadership to help organisations develop governance frameworks, strengthen operational resilience, improve executive reporting and align cyber security programmes with regulatory requirements such as CPS 230 and CPS 234.
To support continuous improvement, Intrix also delivers independent Security Risk Assessments that evaluate existing security controls, identify operational risks and provide prioritised recommendations to strengthen resilience. Together, these services help organisations build a practical, risk-based approach to operational resilience while demonstrating stronger governance to boards, regulators and stakeholders.
For organisations seeking additional guidance, APRA’s Prudential Standard CPS 230 Operational Risk Management provides the complete regulatory requirements and supporting information on implementing the standard.
