- ClassificationCategoryCybersecurityDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeGuidanceLegal InstrumentGuidelineSectorFinancial SectorIndustryFinancial Services
- Region / PublisherRegionAustralia & New ZealandRegion DetailAustraliaPublisherAustralian Prudential Regulation Authority (APRA)
- VersioningVersionCPG 234 Information Security (June 2019)Effective DateJune 2019Issue DateJune 2019
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
APRA licenses CPG 234 under Creative Commons Attribution 3.0 Australia, which allows the text to be copied, distributed, and adapted with attribution and without implying APRA endorsement. The text is not included with the platform.
Framework text is licensed by its publisher and is included only where stated above.
- APRA CPG 234 (June 2019) is APRA's practice guide to Prudential Standard CPS 234, which has applied since July 1, 2019.
- It applies to authorized deposit-taking institutions, general insurers, life companies, private health insurers, and RSE licensees.
- The guide creates no enforceable requirements; the obligations sit in CPS 234, and the Board is ultimately responsible for information security.
- CPS 234 requires notice to APRA within 72 hours of a material incident and 10 business days of a material control weakness.
- SmartSuite Compliance Management holds each CPS 234 requirement against controls, tests, and evidence, with Enterprise Reporting for Board reporting.
Overview
APRA Prudential Practice Guide CPG 234 Information Security (June 2019) is the Australian Prudential Regulation Authority's guidance on sound practice for meeting Prudential Standard CPS 234, which has applied to APRA-regulated entities since 1 July 2019. Those entities are authorized deposit-taking institutions, general insurers, life companies, private health insurers, and RSE licensees (CPS 234, paragraph 2). The guide does not itself create enforceable requirements; the obligations sit in CPS 234.
CPG 234 is written for boards, senior management, and risk and information security specialists. It covers roles and responsibilities, information security capability, the policy framework, information asset identification and classification, implementation of controls, incident management, testing control effectiveness, internal audit, and notification, with Attachments A to H on security principles, training, identity and access, software security, cryptography, customer security, testing techniques, and reporting.
Entities treat its examples as illustrations, not checklists: the guide says its examples are not exhaustive compliance checklists and that an entity has flexibility to maintain information security in the way best suited to its objectives. In practice, implementation means mapping each CPS 234 paragraph to controls, owners, tests, and Board reporting.
Why does it matter?
CPS 234 makes the Board ultimately responsible for information security, and CPG 234 shows what APRA regards as credible oversight, testing, and assurance.
Key benefits include:
- Board-ready oversight
The Considerations for the Board section lists six areas for a Board to challenge management on: roles and responsibilities, capability, policy framework, controls, testing, and internal audit.
- Controls across the asset life-cycle
Controls are expected at every stage from planning and design to decommissioning, with responsibility allocated to a named information asset owner.
- Third-party reach
CPS 234 extends capability, control design, testing, and internal audit assurance to information assets managed by related parties and third parties (paragraphs 16, 22, 28, and 34).
- Clear notification triggers
CPS 234 requires notice to APRA within 72 hours of a material incident and within 10 business days of a material control weakness that will not be remediated in time (paragraphs 35 and 36).
- Independent assurance
Testing must be systematic and done by skilled, functionally independent specialists, and internal audit reviews the design and operating effectiveness of controls (paragraphs 27 to 34).
How does it work?
CPS 234 sets the requirements and CPG 234 explains APRA's view of sound practice against them. The standard requires entities to define information security roles (paragraph 14), maintain a capability commensurate with threats (15), keep a policy framework (18), classify assets by criticality and sensitivity (20), implement controls commensurate with threats, criticality, life-cycle stage, and consequences (21), maintain response plans that are reviewed and tested annually (24 to 26), run a systematic testing program (27), and have internal audit review controls (32).
The guide's incident management section covers detection, including logging, monitoring against a baseline of normal activity, and closer monitoring of privileged accounts, and response plans for incidents that could plausibly occur, such as ransomware, a data breach, credential compromise, or a denial-of-service attack. It also explains how CPS 232 and CPS 234 notifications interact. CPS 230 Operational Risk Management has applied since 1 July 2025 and leaves CPS 234 in place.
In SmartSuite, Compliance Management ties each CPS 234 paragraph and CPG 234 practice to controls, tests, and evidence, and Third Party Risk Management tracks assets managed by related parties and third parties.
Key Elements
- Roles and responsibilities (CPS 234, paragraphs 13 and 14)
The Board is ultimately responsible for information security. The entity defines the roles of the Board, senior management, governing bodies, and individuals with decision-making, approval, oversight, and operational responsibilities.
- Information security capability (paragraphs 15 to 17)
The capability must match the size and extent of threats, be assessed for related and third parties managing information assets, and be kept current as vulnerabilities, threats, and information assets change.
- Policy framework and principles (paragraphs 18 and 19, Attachment A)
The policy framework gives direction on the responsibilities of everyone who must maintain information security. Attachment A lists common principles such as defense in depth, least privilege, timely detection, and secure by design.
- Asset identification and classification (paragraph 20)
Information assets, including those managed by related and third parties, are classified by criticality, the potential impact of a loss of availability, and sensitivity, the potential impact of a loss of confidentiality or integrity.
- Implementation of controls (paragraphs 21 and 22)
Controls fit the asset's life-cycle stage. The guide lists categories such as change, configuration, access, vulnerability, patch, monitoring, capacity, and service provider management, and requires the design of a third party's controls to be evaluated.
- Incident management and notification (paragraphs 23 to 26, 35, and 36)
Response plans cover every stage from detection to post-incident review and escalation to the Board. APRA expects notification as soon as possible, even without complete information, using its electronic forms.
- Testing and internal audit (paragraphs 27 to 34)
The testing program scales with the rate of change in threats, asset criticality and sensitivity, consequences, untrusted environments, and the materiality of change, and its sufficiency is reviewed at least annually. Internal audit reviews design and operating effectiveness.
What does it cover?
CPS 234 applies to authorized deposit-taking institutions (for a foreign ADI, only its Australian branch operations), general insurers, life companies, private health insurers, and RSE licensees, and on a group basis where the entity is the Head of a group (paragraphs 2 to 4). Where a third party manages an entity's information assets, CPS 234 applied from the earlier of the next contract renewal or 1 July 2020 (paragraph 6). CPG 234 is aimed at the boards and specialists of those entities.
What are its objectives?
CPS 234 aims to make APRA-regulated entities resilient to information security incidents, including cyber-attacks, and CPG 234 supports that aim.
Define the information security roles and responsibilities of the Board, senior management, governing bodies, and individuals.
Maintain an information security capability commensurate with the size and extent of threats to information assets.
Implement controls commensurate with criticality and sensitivity, and test their effectiveness systematically.
Minimize the likelihood and impact of incidents on confidentiality, integrity, and availability, including for assets managed by related and third parties.
Notify APRA of material information security incidents.
Framework in Context
CPG 234 is the guide to CPS 234 within APRA's operational risk guidance. CPS 230 Operational Risk Management has applied since 1 July 2025; it requires entities to meet CPS 234 (CPS 230, paragraph 25) and says an incident reported under CPS 234 need not be reported again under CPS 230. The 2019 guide still refers to CPS 231 and CPS 232. Entities commonly map CPG 234 to ISO/IEC 27001 and the ASD Essential Eight, although the guide states it is not intended to replace or endorse industry standards.
Common Framework Mappings
Entities that follow CPG 234 usually map it to the frameworks below; the guide itself says it does not replace or endorse existing industry standards.
Mapped frameworks include:
APRA CPS 234
ASD Essential Eight
CIS Controls v8.1
ISO 27001:2022
ISO 27002:2022
ISO 27701
NIST CSF 2.0
NIST 800-53 Rev.5
How SmartSuite Supports APRA CPG 234
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management to hold each CPS 234 requirement and CPG 234 practice against controls, tests, and evidence, and Enterprise Reporting for Board reporting.
CPS 234 requirement map
Map CPS 234 paragraphs 13 to 36 and the matching CPG 234 practices to controls and owners.
Asset classification
Record information assets with criticality and sensitivity ratings and an accountable information asset owner.
Incident and notification workflow
Run incidents from detection to post-incident review with Workflow Orchestration, tracking the 72-hour and 10-business-day notification clocks.
Testing and internal audit
Plan the systematic testing program and internal audit reviews, record results, and escalate deficiencies that cannot be remediated in time.
Third-party assurance
Assess related-party and third-party capability and controls, and record the assurance reports internal audit relies on, using Third Party Risk Management.
Board reporting
Use Enterprise Reporting to show control health, testing coverage, incidents, and open weaknesses to the Board.
Related frameworks
APRA CPS 234 is the prudential standard that requires APRA-regulated entities to maintain information security capability, test controls, and notify APRA of incidents within 72 hours.
The Essential Eight is ASD's baseline of eight mitigation strategies and four maturity levels for protecting internet-connected IT networks against common cyber threats.
CIS Controls v8.1 is a prioritized set of 18 Controls and 153 Safeguards, in three Implementation Groups, with a new Govern function.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
Frequently Asked Questions For APRA CPG 234 (Information Security Prudential Practice Guide)
No. A prudential practice guide describes APRA's view of sound practice and does not itself create enforceable requirements. The enforceable obligations are in Prudential Standard CPS 234 Information Security, which CPG 234 helps entities implement.
All APRA-regulated entities: authorized deposit-taking institutions (including foreign ADIs for their Australian branch operations), general insurers, life companies, private health insurers, and RSE licensees. CPS 234 commenced on 1 July 2019.
CPS 234 requires notice as soon as possible and no later than 72 hours after an entity becomes aware of an incident that materially affected, or could materially affect, the entity or its customers, or that has been notified to other regulators. A material control weakness that will not be remediated in time must be notified within 10 business days. CPG 234 says to notify even without complete information.
CPS 230 Operational Risk Management has applied since 1 July 2025. It requires entities to meet CPS 234 and says an information security incident reported under CPS 234 does not need to be reported separately under CPS 230. CPG 234 dates from June 2019 and predates CPS 230.
No. The guide says it is not intended to replace or endorse existing industry standards, and that an entity would typically use discretion in adopting the standards it considers fit for purpose in specific control areas.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.