CPS 234 vs Cyber Essentials
APRA CPS 234 Information Security · UK Cyber Essentials (NCSC) · data 2026-10-27
Requirement-level comparison of APRA CPS 234 Information Security and UK Cyber Essentials (NCSC), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 5 UK Cyber Essentials (NCSC) requirements, 1 map to something in CPS 234, 1 are only loosely related, and 3 have no mapping in our data.
Cyber Essentials certifies five technical controls only; governance, risk assessment, incident response and backup are deliberately outside its scope. All links are editorial.
Likely new work: Cyber Essentials requirements with no mapping to CPS 234 (3)
| Cyber Essentials | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Technical controls · 3 | ||||
| CE 1 | Firewalls | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CE 2 | Secure Configuration | No mapping in our data | — | No mapping to CPS 234 in our data. |
| CE 5 | Malware protection | No mapping in our data | — | No mapping to CPS 234 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| Cyber Essentials | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Technical controls · 1 | ||||
| CE 4 | User Access Control | Para 20 | Only shares CSF ID.AM-04: related, not a mapping | |
Mapped (1)
| Cyber Essentials | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| Technical controls · 1 | ||||
| CE 3 | Security Update Management | Editorial | Para 17Para 20Para 27+1 | Same topic: Vulnerability Mgmt, Asset Management (editorial pick) |
Of 24 APRA CPS 234 Information Security requirements, 4 map to something in Cyber Essentials, 0 are only loosely related, and 20 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to Cyber Essentials (20)
| CPS 234 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 2 | ||||
| Para 13 | Board ultimately responsible for information security | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 14 | Define information security roles and responsibilities | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Information security capability · 2 | ||||
| Para 15 | Maintain a capability commensurate with threats | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 16 | Assess third parties' information security capability | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 19 | Policies direct everyone with security obligations | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Implementation of controls · 2 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 22 | Evaluate the design of third parties' controls | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 24 | Maintain information security response plans | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 25 | Response plans cover all stages and escalation | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 26 | Review and test response plans annually | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Testing control effectiveness · 3 | ||||
| Para 28 | Check third parties' control testing is adequate | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 31 | Review the testing programme at least annually | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Internal audit · 3 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 33 | Assurance provided by appropriately skilled personnel | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 34 | Internal audit assesses third-party assurance relied on | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | No mapping in our data | — | No mapping to Cyber Essentials in our data. |
Mapped (4)
| CPS 234 | Requirement | Match | Cyber Essentials | Evidence |
|---|---|---|---|---|
| Information security capability · 1 | ||||
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | CE 3 | Same topic: Asset Management (editorial pick) |
| Testing control effectiveness · 2 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | CE 3 | Same topic: Vulnerability Mgmt (editorial pick) |
By topic
Both cover (2):
Only CPS 234 (15):
Only Cyber Essentials (9):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.