APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA adds

APRA's Prudential Standard CPS 234 Information Security has applied to Australian banks, insurers and superannuation trustees since 1 July 2019. It is short: the operative requirements fit in 24 paragraphs, and they describe outcomes rather than controls. That makes it a natural fit for an organisation that already runs an ISO 27001 information security management system, and the most common question is how much of CPS 234 the ISMS already answers.

The headline number

Of the 24 CPS 234 paragraphs, 23 (96%) map to something in ISO 27001, 0 are only loosely related and 1 have no mapping in our data. Open the gap report →

APRA publishes no crosswalk, so every link here is ControlMapping editorial, made paragraph by paragraph against the same security topics as ISO 27001. The full list:

CPS 234	Requirement	Match	ISO 27001
Para 13	Board ultimately responsible for information security	Editorial	A.5.2A.5.4Clause 6.1.1Clause 6.1.3
Para 14	Define information security roles and responsibilities	Editorial	A.5.2A.5.4
Para 15	Maintain a capability commensurate with threats	Editorial	Clause 6.1.1Clause 6.1.3
Para 16	Assess third parties' information security capability	Editorial	A.5.19A.5.20A.5.21A.5.22
Para 17	Keep capability current as threats and vulnerabilities change	Editorial	A.5.7A.8.8Clause 6.1.2Clause 6.1.3
Para 18	Maintain an information security policy framework	Editorial	A.5.1A.5.37Clause 5.2
Para 19	Policies direct everyone with security obligations	Editorial	A.5.1A.5.37Clause 5.2
Para 20	Classify information assets by criticality and sensitivity	Editorial	A.5.9A.5.11A.5.12A.5.13
Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	A.5.14A.8.10A.8.11Clause 6.1.2
Para 22	Evaluate the design of third parties' controls	Editorial	A.5.19A.5.20A.5.21A.5.22
Para 23	Detect and respond to incidents in a timely manner	Editorial	A.5.24A.5.25A.5.26A.8.16
Para 24	Maintain information security response plans	Editorial	A.5.24A.5.25A.5.26
Para 25	Response plans cover all stages and escalation	Editorial	A.5.6A.5.24A.5.25A.5.26
Para 26	Review and test response plans annually	Editorial	A.5.24A.5.25A.5.26
Para 27	Systematic testing programme for control effectiveness	Editorial	A.8.8Clause 6.1.1Clause 6.1.3
Para 28	Check third parties' control testing is adequate	Editorial	A.5.19A.5.20A.5.22
Para 29	Escalate deficiencies that can't be fixed quickly	No mapping in our data	—
Para 30	Testing by skilled, functionally independent specialists	Editorial	A.8.8
Para 31	Review the testing programme at least annually	Editorial	Clause 6.1.1Clause 6.1.3
Para 32	Internal audit reviews control design and effectiveness	Editorial	A.5.31A.5.36Clause 9.1
Para 33	Assurance provided by appropriately skilled personnel	Editorial	A.5.31A.5.36Clause 9.1
Para 34	Internal audit assesses third-party assurance relied on	Editorial	A.5.19A.5.20A.5.22A.5.31
Para 35	Notify APRA of material incidents within 72 hours	Editorial	A.5.5A.6.8
Para 36	Notify APRA of material control weaknesses within 10 business days	Editorial	A.5.5A.6.8

The match is close because CPS 234 and ISO 27001 share a shape: a policy framework, classification of information assets, controls chosen by risk, incident management, testing and internal audit.

What CPS 234 adds

The links show where to look; the detail is where CPS 234 goes further.

• The Board is ultimately responsible for information security (paragraph 13), and roles must be defined from the Board down (paragraph 14). ISO 27001 asks top management to show leadership and commitment; CPS 234 puts the responsibility on the Board by name, and APRA supervises how it is exercised.
• Third parties are inside the perimeter. You must assess the security capability of any related party or third party that manages your information assets (paragraph 16), evaluate the design of their controls (paragraph 22), check that their control testing meets your own standard if you rely on it (paragraph 28), and have internal audit assess the assurance they give you (paragraph 34). ISO 27001's supplier controls (A.5.19 to A.5.22) cover the same ground; CPS 234 is explicit about verifying third parties' controls, not only contracting for them.
• Testing by independent specialists. Control testing must be systematic, with a frequency driven by threats, criticality and change (paragraph 27), and carried out by appropriately skilled and functionally independent specialists (paragraph 30). Deficiencies that can't be fixed in time go to the Board or senior management (paragraph 29).
• Response plans tested every year (paragraph 26). ISO 27001 requires incident planning but sets no frequency.
• Telling APRA. Notify APRA within 72 hours of becoming aware of a material information security incident (paragraph 35), and within 10 business days of a material control weakness you can't remediate in time (paragraph 36). An ISMS has no regulator clock.

The other direction

Of the 123 ISO 27001 Annex A controls and ISMS clauses, 35 (28%) map to something in CPS 234, 40 are only loosely related and 48 have no mapping in our data. Open the gap report →

Most of ISO 27001 has no link to CPS 234 in our data. That isn't because CPS 234 doesn't care about access control, encryption or physical security: it requires controls commensurate with your threats without naming them. If you're building for CPS 234 without an ISMS, Annex A is a sensible catalogue to choose those controls from, and APRA's guide CPG 234 describes what it considers better practice.

A practical plan

1. Map your Statement of Applicability to the CPS 234 paragraphs above; the gap analysis exports it as a tracker.
2. Add Board reporting that shows the Board exercising its responsibility, not just receiving reports.
3. Strengthen third-party assurance for every party that manages your information assets, not only outsourced material business activities.
4. Check tester independence and the frequency rules for your testing programme.
5. Write the APRA notification procedure with both deadlines, and test it with your response plans each year.
6. Read CPS 230 alongside it. Since 1 July 2025, APRA's operational risk standard covers business continuity and service providers, which CPS 234 doesn't.

Key takeaways

• An ISO 27001 ISMS addresses nearly every CPS 234 paragraph.
• CPS 234's extra work is Board responsibility, third-party assurance, independent testing and APRA notification.
• CPS 234 doesn't name controls, so ISO 27001's Annex A is a good place to choose them from.

Where to go next

The CPS 234 framework page lists every paragraph with APRA's text, and the ISO 27001 vs CPS 234 comparison shows both directions. Our ISO 27001 guide covers certification.

Questions

Does ISO 27001 certification satisfy APRA CPS 234?

Not on its own. An ISO 27001 ISMS addresses nearly every CPS 234 paragraph, but APRA supervises CPS 234 directly, and the standard adds specific obligations: the Board's ultimate responsibility, assessing and testing third parties' controls, testing by functionally independent specialists, and notifying APRA within 72 hours of a material incident and within 10 business days of a material control weakness.

Is there an official mapping between CPS 234 and ISO 27001?

APRA doesn't publish one. The links on ControlMapping are editorial, made paragraph by paragraph, and each shows its reason.

What is CPG 234?

APRA's Prudential Practice Guide CPG 234 describes better practice for meeting CPS 234. It names specific practices, but it isn't binding, and ControlMapping doesn't map it.