APRA CPS 234 is the prudential standard on information security for APRA-regulated entities. It requires them to maintain information security capabilities matched to their threats, clearly assign responsibilities, control and test their defences, and notify APRA of material incidents. In short, it makes information security a board-level obligation, not just an IT concern.
What CPS 234 is and who it applies to
CPS 234 is the Australian Prudential Regulation Authority’s prudential standard for information security. It applies to APRA-regulated entities, which includes banks and other authorised deposit-taking institutions, insurers, and superannuation trustees. The aim is straightforward: to ensure that entities holding money and sensitive data can withstand and respond to information security incidents.
The standard’s importance comes from who it applies to. These are organisations whose failure has broad consequences, so APRA sets clear, enforceable expectations rather than leaving information security to discretion. For a regulated entity, CPS 234 is not optional guidance. It is a compliance obligation with a regulator behind it.
The core requirements
CPS 234 sets out a set of connected obligations. At a high level, a regulated entity must:
- Maintain information security capability appropriate to the size and extent of the threats it faces
- Clearly define the information security roles and responsibilities of the board, management and others
- Implement controls to protect information assets, and keep those controls sound as threats change
- Test the effectiveness of its controls through a systematic testing programme
- Notify APRA promptly of material information security incidents and control weaknesses
The thread running through all of these is accountability. CPS 234 makes clear that information security is a board and management responsibility, not something that can be delegated away to a technical team and forgotten.
The testing expectation and why it matters
One of the most practically significant parts of CPS 234 is the requirement to test information security controls. The standard expects testing to be systematic and appropriate to the rate at which threats and the environment change, and it expects the results to be acted upon.
This matters because controls that are never tested drift toward ineffectiveness without anyone noticing. A control can look correct on paper and fail in practice. Regular, meaningful testing, including independent testing where appropriate, is how a regulated entity gains genuine assurance that its defences work, rather than assuming they do. It also produces the evidence that demonstrates compliance.
Third-party and service provider information security
CPS 234 recognises that regulated entities rely heavily on third parties, and it does not let that reliance become a gap. Where information assets are managed by a related party or a third party, the entity remains responsible for ensuring those assets are protected to the standard CPS 234 requires.
In practice, that means assessing the information security of service providers, setting expectations, and gaining assurance that those expectations are met. A regulated entity cannot outsource its CPS 234 responsibility along with the service. The obligation follows the data.
How CPS 234 relates to CPS 230
It helps to place CPS 234 alongside CPS 230, the operational risk management standard. CPS 234 is specifically about information security: protecting the confidentiality, integrity and availability of information assets. CPS 230 is broader, covering operational risk management and the ability to keep critical operations running through disruptions of all kinds, including but not limited to cyber.
The two are complementary. CPS 234 hardens your information security. CPS 230 ensures the business can withstand and recover from disruption. A regulated entity needs to meet both, and a cyber incident is precisely the kind of event that engages each of them at once.
Practical steps toward meeting and evidencing it
Meeting CPS 234 is less about a single project and more about an ongoing capability. The practical foundations are knowing your information assets and the threats to them, assigning clear responsibilities up to board level, implementing and maintaining controls that match those threats, and testing regularly so you have real assurance and real evidence. Preparing to notify APRA quickly when something material happens rounds it out.
Bringing in experienced security leadership can accelerate this, particularly around governance, the testing programme and the evidence APRA expects to see. Our virtual CISO services can provide that leadership, and a security risk assessment gives you the view of assets and threats that the whole standard builds on.
For the standard itself, refer to APRA CPS 234.
Frequently asked questions
What is APRA CPS 234?
CPS 234 is the Australian Prudential Regulation Authority’s prudential standard for information security. It requires regulated entities to maintain information security capabilities matched to their threats, assign clear responsibilities, control and test their defences, and notify APRA of material incidents.
Who does CPS 234 apply to?
It applies to APRA-regulated entities, including banks and other authorised deposit-taking institutions, insurers and superannuation trustees. It also reaches the information security of related parties and third parties that manage a regulated entity’s information assets, since the entity remains responsible for that data.
What does CPS 234 require for testing?
CPS 234 requires entities to test the effectiveness of their information security controls through a systematic programme, appropriate to how quickly threats and the environment change, and to act on the results. Testing provides genuine assurance that controls work and produces the evidence of compliance.
How is CPS 234 different from CPS 230?
CPS 234 is specifically about information security, protecting the confidentiality, integrity and availability of information assets. CPS 230 is broader, covering operational risk management and resilience across all disruptions. They are complementary, and a cyber incident typically engages both at once.
