APRA CPS-234 Compliance

Overview

APRA CPS 234 establishes a binding set of information security obligations for all APRA-regulated entities. The standard is principles-based, requiring entities to maintain information security commensurate with the size and extent of threats to their information assets. It does not prescribe specific controls but requires entities to demonstrate that their approach is proportionate and effective.

A distinctive feature of CPS 234 is its emphasis on board accountability. Boards must ensure that the entity's information security capability is maintained, that roles and responsibilities are clearly defined, and that they receive adequate reporting on the state of information security. This elevates cybersecurity from an IT concern to a board-level strategic risk.

The standard extends its reach to third parties through requirements for managing information security in relation to material service provider arrangements. Entities must assess the information security capability of their providers, include appropriate contractual protections, and monitor compliance on an ongoing basis.

Control testing is a critical component. Entities must systematically test the effectiveness of their information security controls through a program that includes vulnerability assessments, penetration testing, and scenario analysis. Internal audit must provide independent assurance, and testing results must inform remediation priorities and board reporting.

Key Areas

• Board and senior management accountability for information security
• Information asset identification and classification
• Implementation of controls commensurate with asset criticality and threat environment
• Incident management and notification to APRA within 72 hours for material incidents
• Testing the effectiveness of information security controls
• Internal audit assurance over information security
• Management of information security capability in relation to third-party and related-party arrangements
• Ongoing assessment of information security vulnerabilities and threats

Who It's For

• Australian banks, building societies, and credit unions regulated by APRA
• General insurers, life insurers, and private health insurers
• Registrable superannuation entity licensees and their trustees
• Material service providers to APRA-regulated entities

Core Requirements

Policies and Governance

Boards must ensure that the entity maintains information security commensurate with its risk profile. Clear roles and responsibilities must be defined for information security management, including the authority and resources required to maintain the capability.

Risk Management

Entities must classify information assets by criticality and sensitivity, identify threats and vulnerabilities, and implement controls proportionate to the risk. Regular reassessment of the threat landscape and control adequacy is required.

Security Controls

Controls must protect information assets throughout their lifecycle and be commensurate with the criticality of the asset and the nature of the threats. This includes access controls, encryption, network security, and application security measures.

Incident Response

Entities must have mechanisms to detect and respond to information security incidents. Material incidents must be notified to APRA within 72 hours. Post-incident reviews must identify root causes and drive improvements to the control environment.

Evidence and Reporting

Systematic testing of control effectiveness must occur through a combination of internal audit, penetration testing, vulnerability assessments, and scenario-based exercises. Results must be reported to the board and used to inform remediation priorities.

Implementation Steps

1. Scope and objectives - Identify all information assets across the entity, including those managed by third parties. Classify assets by criticality and sensitivity. Define the scope of the CPS 234 compliance program and establish board-approved objectives.
2. Gap assessment - Assess the current information security capability against CPS 234 requirements. Identify gaps in governance, control design, testing, incident management, and third-party oversight. Document findings and prioritise remediation.
3. Control implementation - Implement or strengthen controls to address identified gaps. Ensure controls are proportionate to asset criticality and the threat environment. Establish or update policies, deploy technical controls, and formalise incident response procedures.
4. Evidence and documentation - Build an evidence framework that captures control design documentation, testing results, incident logs, board reports, and third-party assurance artefacts. Maintain records that demonstrate ongoing compliance for regulatory review.
5. Review and continuous improvement - Conduct regular control testing, including independent assurance from internal audit. Review the information security capability against evolving threats and adjust controls accordingly. Report outcomes to the board and APRA as required.

Frequently Asked Questions

Who must comply with CPS 234?

All APRA-regulated entities including banks, insurers, and superannuation funds. The requirements also extend to material service providers through contractual obligations.

What is a material information security incident under CPS 234?

An incident that could materially affect the entity or the interests of depositors, policyholders, or fund members. This includes incidents at material service providers.

How quickly must incidents be reported to APRA?

Material information security incidents must be notified to APRA within 72 hours of the entity becoming aware of the incident.

Does CPS 234 require specific technical controls?

No. CPS 234 is principles-based. It requires controls commensurate with the criticality of information assets and the threat environment, but does not prescribe specific technologies.

How does CPS 234 relate to CPS 230?

CPS 230 consolidates operational risk management requirements including aspects of information security. Entities should manage CPS 234 and CPS 230 compliance in an integrated manner.

What role does the board play?

The board must ensure the entity maintains information security commensurate with its risk profile, approve the information security policy, and receive regular reporting on the state of information security.

Is there a formal CPS 234 certification?

No. Compliance is monitored by APRA through supervisory activities. Entities should maintain evidence of compliance for regulatory review.

Why It Matters

• Financial institutions are high-value targets for cyber adversaries due to the volume of sensitive data and financial assets they manage. CPS 234 ensures that APRA-regulated entities implement information security controls proportionate to these threats, reducing the risk of breaches that could affect depositors, policyholders, and fund members.
• The standard addresses a critical governance gap by mandating board-level accountability for information security. This ensures that cybersecurity is treated as a strategic risk rather than solely a technical concern, elevating the conversation to the appropriate level within the organisation.
• CPS 234 also strengthens the financial system as a whole by setting a consistent baseline across all regulated entities and extending requirements to their material service providers. This systemic approach reduces concentration risk and improves resilience across the sector.

Common Challenges

• Achieving genuine board engagement with information security rather than treating it as a compliance checkbox
• Extending CPS 234 requirements to material service providers, particularly where contractual arrangements predate the standard
• Maintaining a current and accurate information asset register across complex, legacy environments
• Meeting the 72-hour notification requirement for material information security incidents
• Ensuring internal audit has sufficient cybersecurity expertise to provide meaningful assurance
• Balancing the cost of control implementation with the principle of proportionality
• Coordinating CPS 234 compliance with overlapping requirements from CPS 230 and other APRA standards