Introducing APRA CPS 234 – Information Security for APRA-Regulated Entities

Mandated by the Australian Prudential Regulation Authority (APRA), CPS 234 provides the binding information security requirements that APRA-regulated entities must implement to protect information assets from cyber threats and operational disruptions. It helps regulated entities establish clear accountability for information security, maintain robust control environments, and ensure that security capabilities remain commensurate with the size, nature, and complexity of threats they face.

The benefits of CPS 234 compliance

Demonstrating compliance with CPS 234 confirms your organization’s commitment to maintaining the information security standards required to protect policyholders, depositors, fund members, and the broader financial system.

By meeting the requirements of CPS 234, APRA-regulated entities can demonstrate to regulators, boards, and stakeholders that information assets are adequately protected, cyber incidents are managed effectively, and information security accountability is clearly defined and exercised at the highest levels of the organization.

Why organizations comply with CPS 234?

APRA-regulated entities — including authorized deposit-taking institutions, general and life insurers, and registrable superannuation entity licensees — are required to comply with CPS 234 as a condition of their authorization and continued operation. CPS 234 reflects APRA’s recognition that information security incidents pose a material prudential risk to regulated entities and the financial system, requiring enforceable minimum standards rather than voluntary guidance.

Capability & Control

A primary requirement of CPS 234 is the maintenance of information security capabilities commensurate with the size and extent of threats to the entity’s information assets. This requires regulated entities to continuously assess their threat environment, identify and classify information assets by criticality and sensitivity, implement layered security controls across people, processes, and technology, and verify the effectiveness of those controls through regular testing and assurance activities.

Supply Chain Security

CPS 234 imposes specific obligations for supply chain and third-party risk management. Where information assets are managed by a related party or third-party service provider, the regulated entity retains full accountability for ensuring that those parties maintain security controls commensurate with the entity’s own requirements. This drives systematic vendor due diligence, contractual security obligations, and ongoing third-party assurance activities across the regulated entity’s supply chain.

Board Accountability

Board and executive accountability are central to CPS 234. The standard requires that the board is responsible for ensuring adequate information security capability and that the entity maintains a clear definition of information security-related roles and responsibilities. This elevates information security from an IT function to a governance obligation, requiring boards to understand, oversee, and attest to the adequacy of the entity’s information security posture.

Incident Notification

CPS 234 also imposes incident notification obligations. Regulated entities are required to notify APRA within 72 hours of becoming aware of an information security incident that has materially affected, or had the potential to materially affect, the entity or its customers. This requirement drives investment in detection, escalation, and incident response capabilities sufficient to support timely regulatory reporting.

Testing & Assurance

Finally, CPS 234 supports continuous improvement through its requirement for regular control testing and independent assurance. Entities must test the effectiveness of their information security controls on a systematic basis and engage internal or external audit to provide independent assurance over the control environment at least annually, ensuring that security capabilities are verified in practice and not merely assumed.

Where is your organization on the path to CPS 234 compliance maturity?

Threat Landscape

Increasing sophistication of cyber threats targeting the Australian financial sector, combined with APRA’s heightened supervisory focus on information security governance and control effectiveness, is driving the need for demonstrated and continuously verified compliance.

Compliance Program

With a mature CPS 234-compliant information security program in place, regulated entities can protect their customers and information assets, satisfy regulatory obligations, and demonstrate the security governance expected of prudentially supervised organizations.

Trust & Protection

This includes effectively managing cyber risk and third-party exposure, to satisfying APRA supervisory expectations and maintaining the trust of depositors, policyholders, and fund members, regardless of the size or complexity of the regulated entity.

APRA CPS 234