Comparison
ISO 27001 vs CPS 234
ISO/IEC 27001:2022 · APRA CPS 234 Information Security · data 2026-10-27
Requirement-level comparison of ISO/IEC 27001:2022 and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 24 APRA CPS 234 Information Security requirements, 23 map to something in ISO 27001, 0 are only loosely related, and 1 have no mapping in our data.
CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.
Likely new work: CPS 234 requirements with no mapping to ISO 27001 (1)
| CPS 234 | Requirement | Match | ISO 27001 | Evidence |
|---|---|---|---|---|
| Testing control effectiveness · 1 | ||||
| Para 29 | Escalate deficiencies that can't be fixed quickly | No mapping in our data | — | No mapping to ISO 27001 in our data. |
Mapped (23)
| CPS 234 | Requirement | Match | ISO 27001 | Evidence |
|---|---|---|---|---|
| Roles and responsibilities · 2 | ||||
| Para 13 | Board ultimately responsible for information security | Editorial | A.5.2A.5.4Clause 6.1.1+1 | Same topic: Roles & Responsibilities, Risk Management (editorial pick) |
| Para 14 | Define information security roles and responsibilities | Editorial | A.5.2A.5.4 | Same topic: Roles & Responsibilities (editorial pick) |
| Information security capability · 3 | ||||
| Para 15 | Maintain a capability commensurate with threats | Editorial | Clause 6.1.1Clause 6.1.3 | Same topic: Risk Management (editorial pick) |
| Para 16 | Assess third parties' information security capability | Editorial | A.5.19A.5.20A.5.21+1 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Para 17 | Keep capability current as threats and vulnerabilities change | Editorial | A.5.7A.8.8Clause 6.1.2+1 | Same topic: Threat Intelligence, Vulnerability Mgmt, Risk Assessment (editorial pick) |
| Policy framework · 2 | ||||
| Para 18 | Maintain an information security policy framework | Editorial | A.5.1A.5.37Clause 5.2 | Same topic: Governance Policy (editorial pick) |
| Para 19 | Policies direct everyone with security obligations | Editorial | A.5.1A.5.37Clause 5.2 | Same topic: Governance Policy (editorial pick) |
| Information asset identification and classification · 1 | ||||
| Para 20 | Classify information assets by criticality and sensitivity | Editorial | A.5.9A.5.11A.5.12+2 | Same topic: Asset Management, Data Classification (editorial pick) |
| Implementation of controls · 2 | ||||
| Para 21 | Timely controls commensurate with risk and asset life-cycle | Editorial | A.5.14A.8.10A.8.11+2 | Same topic: Data Protection (editorial pick) |
| Para 22 | Evaluate the design of third parties' controls | Editorial | A.5.19A.5.20A.5.21+1 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Incident management · 4 | ||||
| Para 23 | Detect and respond to incidents in a timely manner | Editorial | A.5.24A.5.25A.5.26+1 | Same topic: Incident Response (editorial pick) |
| Para 24 | Maintain information security response plans | Editorial | A.5.24A.5.25A.5.26 | Same topic: Incident Response (editorial pick) |
| Para 25 | Response plans cover all stages and escalation | Editorial | A.5.6A.5.24A.5.25+4 | Same topic: Communication, Incident Response (editorial pick) |
| Para 26 | Review and test response plans annually | Editorial | A.5.24A.5.25A.5.26 | Same topic: Incident Response (editorial pick) |
| Testing control effectiveness · 4 | ||||
| Para 27 | Systematic testing programme for control effectiveness | Editorial | A.8.8Clause 6.1.1Clause 6.1.3 | Same topic: Vulnerability Mgmt, Risk Management (editorial pick) |
| Para 28 | Check third parties' control testing is adequate | Editorial | A.5.19A.5.20A.5.22 | Same topic: Vendor Risk Mgmt (editorial pick) |
| Para 30 | Testing by skilled, functionally independent specialists | Editorial | A.8.8 | Same topic: Vulnerability Mgmt (editorial pick) |
| Para 31 | Review the testing programme at least annually | Editorial | Clause 6.1.1Clause 6.1.3 | Same topic: Risk Management (editorial pick) |
| Internal audit · 3 | ||||
| Para 32 | Internal audit reviews control design and effectiveness | Editorial | A.5.31A.5.36Clause 9.1 | Same topic: Compliance (editorial pick) |
| Para 33 | Assurance provided by appropriately skilled personnel | Editorial | A.5.31A.5.36Clause 9.1 | Same topic: Compliance (editorial pick) |
| Para 34 | Internal audit assesses third-party assurance relied on | Editorial | A.5.19A.5.20A.5.22+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| APRA notification · 2 | ||||
| Para 35 | Notify APRA of material incidents within 72 hours | Editorial | A.5.5A.6.8 | Same topic: Reporting (editorial pick) |
| Para 36 | Notify APRA of material control weaknesses within 10 business days | Editorial | A.5.5A.6.8 | Same topic: Reporting (editorial pick) |
Of 123 ISO/IEC 27001:2022 requirements, 35 map to something in CPS 234, 40 are only loosely related, and 48 have no mapping in our data.
Likely new work: ISO 27001 requirements with no mapping to CPS 234 (48)
| ISO 27001 | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 6 | ||||
| A.5.16 | Identity management | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.5.17 | Authentication information | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.5.18 | Access rights | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.5.29 | Information security during disruption | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.5.30 | ICT readiness for business continuity | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.5.35 | Independent review of information security | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.6 People controls · 1 | ||||
| A.6.3 | Information security awareness, education and training | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7 Physical controls · 9 | ||||
| A.7.1 | Physical security perimeters | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7.2 | Physical entry | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7.3 | Securing offices, rooms and facilities | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7.4 | Physical security monitoring | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7.5 | Protecting against physical and environmental threats | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7.6 | Working in secure areas | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7.8 | Equipment siting and protection | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7.11 | Supporting utilities | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.7.12 | Cabling security | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8 Technological controls · 13 | ||||
| A.8.1 | User endpoint devices | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.5 | Secure authentication | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.6 | Capacity management | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.9 | Configuration management | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.14 | Redundancy of information processing facilities | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.18 | Use of privileged utility programs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.21 | Security of network services | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.23 | Web filtering | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.25 | Secure development life cycle | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.27 | Secure system architecture and engineering principles | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.28 | Secure coding | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.29 | Security testing in development and acceptance | No mapping in our data | — | No mapping to CPS 234 in our data. |
| A.8.31 | Separation of development, test and production environments | No mapping in our data | — | No mapping to CPS 234 in our data. |
| ISMS clauses 4–10 · 19 | ||||
| Clause 4.1 | Understanding the organization and its context | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 4.3 | Determining the scope of the ISMS | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 4.4 | Information security management system | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 5.1 | Leadership and commitment | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 5.3 | Organizational roles, responsibilities and authorities | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 6.2 | Information security objectives and planning to achieve them | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 6.3 | Planning of changes | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 7.3 | Awareness | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 7.5.1 | General | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 7.5.2 | Creating and updating | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 7.5.3 | Control of documented information | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 8.2 | Information security risk assessment | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 8.3 | Information security risk treatment | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 9.2.1 | General | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 9.2.2 | Internal audit programme | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 9.3.1 | General | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 9.3.2 | Management review inputs | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 9.3.3 | Management review results | No mapping in our data | — | No mapping to CPS 234 in our data. |
| Clause 10.2 | Nonconformity and corrective action | No mapping in our data | — | No mapping to CPS 234 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (40)
| ISO 27001 | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 9 | ||||
| A.5.3 | Segregation of duties | Para 21Para 13Para 14 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, GV.RR-02: related, not a mapping | |
| A.5.8 | Information security in project management | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.5.10 | Acceptable use of information and other associated assets | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.5.15 | Access control | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.5.23 | Information security for use of cloud services | Para 21 | Only shares CSF PR.DS-10: related, not a mapping | |
| A.5.28 | Collection of evidence | Para 23Para 24Para 25+1 | Only shares CSF RS.MA-01, RS.MA-02: related, not a mapping | |
| A.5.32 | Intellectual property rights | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| A.5.33 | Protection of records | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.5.34 | Privacy and protection of PII | Para 18Para 19 | Only shares CSF GV.PO-02: related, not a mapping | |
| A.6 People controls · 6 | ||||
| A.6.1 | Screening | Para 21Para 18Para 19 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, GV.PO-01: related, not a mapping | |
| A.6.2 | Terms and conditions of employment | Para 21Para 18Para 19 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, GV.PO-01: related, not a mapping | |
| A.6.4 | Disciplinary process | Para 18Para 19 | Only shares CSF GV.PO-01: related, not a mapping | |
| A.6.5 | Responsibilities after termination or change of employment | Para 21Para 18Para 19 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, GV.PO-01: related, not a mapping | |
| A.6.6 | Confidentiality or non-disclosure agreements | Para 13Para 14 | Only shares CSF GV.RR-03: related, not a mapping | |
| A.6.7 | Remote working | Para 18Para 19 | Only shares CSF GV.PO-01: related, not a mapping | |
| A.7 Physical controls · 4 | ||||
| A.7.7 | Clear desk and clear screen | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.7.9 | Security of assets off-premises | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.7.10 | Storage media | Para 20Para 21 | Only shares CSF ID.AM-08, PR.DS-01: related, not a mapping | |
| A.7.13 | Equipment maintenance | Para 20 | Only shares CSF ID.AM-08: related, not a mapping | |
| A.8 Technological controls · 17 | ||||
| A.8.2 | Privileged access rights | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.8.3 | Information access restriction | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.8.4 | Access to source code | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.8.7 | Protection against malware | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.8.12 | Data leakage prevention | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.8.13 | Information backup | Para 21Para 25 | Only shares CSF PR.DS-01, RC.RP-06: related, not a mapping | |
| A.8.15 | Logging | Para 23 | Only shares CSF DE.CM-01: related, not a mapping | |
| A.8.17 | Clock synchronization | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.8.19 | Installation of software on operational systems | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.8.20 | Networks security | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.8.22 | Segregation of networks | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.8.24 | Use of cryptography | Para 21 | Only shares CSF PR.DS-02: related, not a mapping | |
| A.8.26 | Application security requirements | Para 21 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping | |
| A.8.30 | Outsourced development | Para 32Para 33Para 34 | Only shares CSF GV.OV-03: related, not a mapping | |
| A.8.32 | Change management | Para 32Para 33Para 34 | Only shares CSF GV.OV-03: related, not a mapping | |
| A.8.33 | Test information | Para 21 | Only shares CSF PR.DS-01: related, not a mapping | |
| A.8.34 | Protection of information systems during audit testing | Para 32Para 33Para 34 | Only shares CSF GV.OV-03: related, not a mapping | |
| ISMS clauses 4–10 · 4 | ||||
| Clause 4.2 | Understanding the needs and expectations of interested parties | Para 21Para 16Para 22+4 | Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10, GV.SC-05…: related, not a mapping | |
| Clause 7.1 | Resources | Para 13Para 14 | Only shares CSF GV.RR-03: related, not a mapping | |
| Clause 7.2 | Competence | Para 13Para 14 | Only shares CSF GV.RR-01, GV.RR-02, GV.RR-03: related, not a mapping | |
| Clause 8.1 | Operational planning and control | Para 16Para 22 | Only shares CSF GV.SC-01, GV.SC-03: related, not a mapping | |
Mapped (35)
| ISO 27001 | Requirement | Match | CPS 234 | Evidence |
|---|---|---|---|---|
| A.5 Organizational controls · 22 | ||||
| A.5.1 | Policies for information security | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
| A.5.2 | Information security roles and responsibilities | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| A.5.4 | Management responsibilities | Editorial | Para 13Para 14 | Same topic: Roles & Responsibilities (editorial pick) |
| A.5.5 | Contact with authorities | Editorial | Para 35Para 36 | Same topic: Reporting (editorial pick) |
| A.5.6 | Contact with special interest groups | Editorial | Para 25 | Same topic: Communication (editorial pick) |
| A.5.7 | Threat intelligence | Editorial | Para 17 | Same topic: Threat Intelligence (editorial pick) |
| A.5.9 | Inventory of information and other associated assets | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| A.5.11 | Return of assets | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| A.5.12 | Classification of information | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| A.5.13 | Labelling of information | Editorial | Para 20 | Same topic: Data Classification (editorial pick) |
| A.5.14 | Information transfer | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| A.5.19 | Information security in supplier relationships | Editorial | Para 16Para 22Para 28+1 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| A.5.20 | Addressing information security within supplier agreements | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| A.5.21 | Managing information security in the ICT supply chain | Editorial | Para 16Para 22 | Same topic: Supply Chain Risk (editorial pick) |
| A.5.22 | Monitoring, review and change management of supplier services | Editorial | Para 16Para 22Para 28+1 | Same topic: Vendor Risk Mgmt (editorial pick) |
| A.5.24 | Information security incident management planning and preparation | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| A.5.25 | Assessment and decision on information security events | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| A.5.26 | Response to information security incidents | Editorial | Para 23Para 24Para 25+1 | Same topic: Incident Response (editorial pick) |
| A.5.27 | Learning from information security incidents | Editorial | Para 25 | Same topic: Lessons Learned (editorial pick) |
| A.5.31 | Legal, statutory, regulatory and contractual requirements | Editorial | Para 32Para 33Para 34 | Same topic: Compliance (editorial pick) |
| A.5.36 | Compliance with policies, rules and standards for information security | Editorial | Para 32Para 33Para 34 | Same topic: Compliance (editorial pick) |
| A.5.37 | Documented operating procedures | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
| A.6 People controls · 1 | ||||
| A.6.8 | Information security event reporting | Editorial | Para 35Para 36 | Same topic: Reporting (editorial pick) |
| A.7 Physical controls · 1 | ||||
| A.7.14 | Secure disposal or re-use of equipment | Editorial | Para 20 | Same topic: Asset Management (editorial pick) |
| A.8 Technological controls · 4 | ||||
| A.8.8 | Management of technical vulnerabilities | Editorial | Para 17Para 27Para 30 | Same topic: Vulnerability Mgmt (editorial pick) |
| A.8.10 | Information deletion | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| A.8.11 | Data masking | Editorial | Para 21 | Same topic: Data Protection (editorial pick) |
| A.8.16 | Monitoring activities | Editorial | Para 23 | Same topic: Intrusion Detection (editorial pick) |
| ISMS clauses 4–10 · 7 | ||||
| Clause 5.2 | Policy | Editorial | Para 18Para 19 | Same topic: Governance Policy (editorial pick) |
| Clause 6.1.1 | General | Editorial | Para 13Para 15Para 27+1 | Same topic: Risk Management (editorial pick) |
| Clause 6.1.2 | Information security risk assessment | Editorial | Para 17Para 21 | Same topic: Risk Assessment (editorial pick) |
| Clause 6.1.3 | Information security risk treatment | Editorial | Para 13Para 15Para 17+3 | Same topic: Risk Management, Risk Assessment (editorial pick) |
| Clause 7.4 | Communication | Editorial | Para 25 | Same topic: Communication (editorial pick) |
| Clause 9.1 | Monitoring, measurement, analysis and evaluation | Editorial | Para 32Para 33Para 34 | Same topic: Compliance (editorial pick) |
| Clause 10.1 | Continual improvement | Editorial | Para 25 | Same topic: Lessons Learned (editorial pick) |
By topic
Both cover (17):
Governance PolicyRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtThreat IntelligenceData ProtectionIntrusion DetectionIncident ResponseCommunicationReportingLessons LearnedVendor Risk Mgmt
Only ISO 27001 (33):
Awareness & TrainingBusiness EnvironmentAccess ControlMulti-Factor AuthEncryptionBackup & RecoveryPrivileged AccessFirewall / Net SegEndpoint ProtectionPatch ManagementSecure ConfigSecure DevelopmentEmail SecurityWeb SecurityZero TrustMobile SecurityCloud SecurityDNS SecurityWAFDLPCont. MonitoringLogging & AuditAnomaly DetectionSIEM / SOCForensicsMitigationRecovery PlanningBusiness ContinuityComms & RestoreDisaster RecoveryAPI SecurityInsider ThreatPhysical Security
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.