Australia Prudential Standard CPS 234 — Information Security

Why does it matter?

CPS 234 makes information security a Board accountability and sets fixed notification clocks, so entities need evidence of testing, assurance, and incident handling that they can produce quickly.

Key benefits include:

• Board accountability

The Board of an APRA-regulated entity is ultimately responsible for information security and must ensure it is maintained in line with the size and extent of threats (paragraph 13).

• Third-party coverage

Capability assessment, control design evaluation, testing assurance, and internal audit apply to assets managed by related parties and third parties, not only those under outsourcing agreements (paragraphs 16, 22, 28, and 34).

• Tested response

Entities keep plans for incidents that could plausibly occur, covering every stage from detection to post-incident review, and review and test them annually (paragraphs 24 to 26).

• Independent testing

A systematic testing program scaled to threats and asset criticality, run by skilled and functionally independent specialists, with its sufficiency reviewed at least annually (paragraphs 27 to 31).

• Clear notification clocks

Notify APRA as soon as possible and within 72 hours of a qualifying incident, and within 10 business days of a material control weakness that will not be remediated in time (paragraphs 35 and 36).

How does it work?

CPS 234 starts with definitions: an information security incident is an actual or potential compromise of information security; criticality is the potential impact of a loss of availability; and sensitivity is the potential impact of a loss of confidentiality or integrity. The requirements follow in groups: roles and responsibilities (paragraphs 13 and 14), capability (15 to 17), policy framework (18 and 19), classification (20), controls (21 and 22), incident management (23 to 26), testing (27 to 31), internal audit (32 to 34), and APRA notification (35 and 36).

Timing matters: the standard commenced on 1 July 2019, and for information assets managed by a third party it applied from the earlier of the next contract renewal date or 1 July 2020 (paragraph 6). A Head of a group must apply it across the group (paragraph 4), and APRA may adjust or exclude a specific requirement for an entity (paragraph 11).

In SmartSuite, Compliance Management ties each paragraph to controls, tests, and evidence, Workflow Orchestration runs the incident and notification steps, and Third Party Risk Management tracks assets managed by related parties and third parties.

Key Elements

• Roles and policy framework (paragraphs 13, 14, 18, and 19)

The Board is ultimately responsible. The entity defines security roles for the Board, senior management, governing bodies, and individuals, and keeps a policy framework that gives direction to staff, contractors, consultants, related parties, third parties, and customers with security obligations.

• Information security capability (paragraphs 15 to 17)

Capability must match the size and extent of threats, be assessed for related and third parties managing information assets, and be actively maintained as vulnerabilities, threats, and assets change.

• Classification (paragraph 20)

Information assets, including those managed by related and third parties, are classified by criticality and sensitivity, reflecting the potential financial and non-financial effect on the entity and on depositors, policyholders, beneficiaries, and other customers.

• Implementation of controls (paragraphs 21 and 22)

Controls are timely and commensurate with vulnerabilities and threats, asset criticality and sensitivity, the life-cycle stage, and the potential consequences of an incident. The design of a third party's controls over the entity's assets must be evaluated.

• Incident management (paragraphs 23 to 26)

Mechanisms to detect and respond to incidents in a timely manner, plans for incidents that could plausibly occur, escalation to the Board, and an annual review and test of the response plans.

• Testing and internal audit (paragraphs 27 to 34)

A systematic testing program scaled to the rate of change in threats, criticality, consequences, untrusted environments, and materiality of change. Deficiencies that cannot be remediated in time are escalated to the Board or senior management. Internal audit reviews the design and operating effectiveness of controls.

• APRA notification (paragraphs 35 and 36)

Within 72 hours of becoming aware of an incident that materially affected, or could materially affect, the entity or its customers, or that has been notified to other regulators; and within 10 business days of a material control weakness the entity expects it cannot remediate in time.

What does it cover?

CPS 234 applies to all APRA-regulated entities: authorized deposit-taking institutions (for a foreign ADI, its Australian branch operations only), general insurers, life companies, private health insurers, and RSE licensees in respect of their business operations (paragraphs 2 and 3). Where an entity is the Head of a group, it must comply in its own capacity, ensure the requirements are applied appropriately throughout the group, and comply on a group basis (paragraph 4).

What are its objectives?

The standard aims to make APRA-regulated entities resilient to information security incidents through five key requirements.

Clearly define the information security roles and responsibilities of the Board, senior management, governing bodies, and individuals.

Maintain an information security capability commensurate with the size and extent of threats to information assets.

Implement controls commensurate with the criticality and sensitivity of information assets, including those managed by related and third parties.

Undertake systematic testing and assurance of the effectiveness of those controls.

Notify APRA of material information security incidents.

Framework in Context

CPG 234 is APRA's guide to this standard and is not itself enforceable. CPS 230 Operational Risk Management has applied since 1 July 2025; it requires entities to meet CPS 234 (CPS 230, paragraph 25), and an information security incident reported under CPS 234 does not need to be reported again under CPS 230. Entities commonly map CPS 234 to ISO/IEC 27001 and the ASD Essential Eight.

Common Framework Mappings

Entities that comply with CPS 234 map its paragraphs to the frameworks below to reuse controls and evidence.

Mapped frameworks include:

ASD Essential Eight

CIS Controls v8.1

EU DORA

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2