Comparison

SOC 2 vs CPS 234

SOC 2 (Trust Services Criteria) · APRA CPS 234 Information Security · data 2026-10-27

Requirement-level comparison of SOC 2 (Trust Services Criteria) and APRA CPS 234 Information Security, in both directions, derived from published crosswalks and ControlMapping's curated topics.

Have SOC 2 → need CPS 234

24 reqs

23 mapped · · 1 no mapping Open in gap view →

Of 24 APRA CPS 234 Information Security requirements, 23 map to something in SOC 2, 0 are only loosely related, and 1 have no mapping in our data.

CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.

Likely new work: CPS 234 requirements with no mapping to SOC 2 (1)

CPS 234	Requirement	Match	SOC 2	Evidence
Testing control effectiveness · 1
Para 29	Escalate deficiencies that can't be fixed quickly	No mapping in our data	—	No mapping to SOC 2 in our data.

Mapped (23)

CPS 234	Requirement	Match	SOC 2	Evidence
Roles and responsibilities · 2
Para 13	Board ultimately responsible for information security	Editorial	CC1.2 CC1.3 CC1.5+3	Same topic: Roles & Responsibilities (editorial pick)
Para 14	Define information security roles and responsibilities	Editorial	CC1.2 CC1.3 CC1.5	Same topic: Roles & Responsibilities (editorial pick)
Information security capability · 3
Para 15	Maintain a capability commensurate with threats	Editorial	CC3.1 CC5.1 CC9.1	Same topic: Risk Management (editorial pick)
Para 16	Assess third parties' information security capability	Editorial	CC9.2	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
Para 17	Keep capability current as threats and vulnerabilities change	Editorial	CC3.2 CC3.3 CC3.4+1	Same topic: Risk Assessment (editorial pick)
Policy framework · 2
Para 18	Maintain an information security policy framework	Editorial	CC1.1 CC5.3	Same topic: Governance Policy (editorial pick)
Para 19	Policies direct everyone with security obligations	Editorial	CC1.1 CC5.3	Same topic: Governance Policy (editorial pick)
Information asset identification and classification · 1
Para 20	Classify information assets by criticality and sensitivity	Editorial	C1.1 CC6.1	Same topic: Data Classification, Asset Management (editorial pick)
Implementation of controls · 2
Para 21	Timely controls commensurate with risk and asset life-cycle	Editorial	C1.2 CC3.2 CC3.3+2	Same topic: Data Protection, Risk Assessment (editorial pick)
Para 22	Evaluate the design of third parties' controls	Editorial	CC9.2	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)
Incident management · 4
Para 23	Detect and respond to incidents in a timely manner	Editorial	CC7.2 CC7.3 CC7.4	Same topic: Intrusion Detection, Incident Response (editorial pick)
Para 24	Maintain information security response plans	Editorial	CC7.3 CC7.4	Same topic: Incident Response (editorial pick)
Para 25	Response plans cover all stages and escalation	Editorial	CC2.3 CC7.3 CC7.4+1	Same topic: Communication, Incident Response (editorial pick)
Para 26	Review and test response plans annually	Editorial	CC7.3 CC7.4	Same topic: Incident Response (editorial pick)
Testing control effectiveness · 4
Para 27	Systematic testing programme for control effectiveness	Editorial	CC3.1 CC5.1 CC7.1+1	Same topic: Risk Management, Vulnerability Mgmt (editorial pick)
Para 28	Check third parties' control testing is adequate	Editorial	CC9.2	Same topic: Vendor Risk Mgmt (editorial pick)
Para 30	Testing by skilled, functionally independent specialists	Editorial	CC7.1	Same topic: Vulnerability Mgmt (editorial pick)
Para 31	Review the testing programme at least annually	Editorial	CC3.1 CC5.1 CC9.1	Same topic: Risk Management (editorial pick)
Internal audit · 3
Para 32	Internal audit reviews control design and effectiveness	Editorial	CC4.1 CC4.2	Same topic: Compliance (editorial pick)
Para 33	Assurance provided by appropriately skilled personnel	Editorial	CC4.1 CC4.2	Same topic: Compliance (editorial pick)
Para 34	Internal audit assesses third-party assurance relied on	Editorial	CC4.1 CC4.2 CC9.2	Same topic: Compliance, Vendor Risk Mgmt (editorial pick)
APRA notification · 2
Para 35	Notify APRA of material incidents within 72 hours	Editorial	CC2.3	Same topic: Reporting (editorial pick)
Para 36	Notify APRA of material control weaknesses within 10 business days	Editorial	CC2.3	Same topic: Reporting (editorial pick)

Have CPS 234 → need SOC 2

61 reqs

24 mapped · · 34 no mapping Open in gap view →

Of 61 SOC 2 (Trust Services Criteria) requirements, 24 map to something in CPS 234, 3 are only loosely related, and 34 have no mapping in our data.

AICPA's SOC 2 mappings aren't openly licensed, so every SOC 2 link here is ControlMapping editorial: criteria we haven't mapped can't match. Processing-integrity (PI) criteria and most privacy (P) criteria have no equivalent in security frameworks.

Likely new work: SOC 2 requirements with no mapping to CPS 234 (34)

SOC 2	Requirement	Match	CPS 234	Evidence
A1 Availability · 3
A1.1	Capacity management to meet availability commitments	No mapping in our data	—	No mapping to CPS 234 in our data.
A1.2	Environmental protections, backups and recovery infrastructure	No mapping in our data	—	No mapping to CPS 234 in our data.
A1.3	Testing recovery plan procedures	No mapping in our data	—	No mapping to CPS 234 in our data.
CC1 Control environment · 1
CC1.4	Commitment to attracting, developing and retaining competent people	No mapping in our data	—	No mapping to CPS 234 in our data.
CC2 Communication and information · 2
CC2.1	Quality information to support internal control	No mapping in our data	—	No mapping to CPS 234 in our data.
CC2.2	Internal communication of objectives and responsibilities	No mapping in our data	—	No mapping to CPS 234 in our data.
CC5 Control activities · 1
CC5.2	General controls over technology	No mapping in our data	—	No mapping to CPS 234 in our data.
CC6 Logical and physical access · 3
CC6.2	User registration, authorization and removal	No mapping in our data	—	No mapping to CPS 234 in our data.
CC6.3	Role-based access, least privilege and segregation of duties	No mapping in our data	—	No mapping to CPS 234 in our data.
CC6.4	Physical access restrictions	No mapping in our data	—	No mapping to CPS 234 in our data.
CC8 Change management · 1
CC8.1	Change management for infrastructure, data and software	No mapping in our data	—	No mapping to CPS 234 in our data.
P Privacy · 18
P1.1	Privacy notice	No mapping in our data	—	No mapping to CPS 234 in our data.
P2.1	Choice and consent	No mapping in our data	—	No mapping to CPS 234 in our data.
P3.1	Collection limited to privacy objectives	No mapping in our data	—	No mapping to CPS 234 in our data.
P3.2	Explicit consent where required	No mapping in our data	—	No mapping to CPS 234 in our data.
P4.1	Use limited to privacy objectives	No mapping in our data	—	No mapping to CPS 234 in our data.
P4.2	Retention of personal information	No mapping in our data	—	No mapping to CPS 234 in our data.
P4.3	Disposal of personal information	No mapping in our data	—	No mapping to CPS 234 in our data.
P5.1	Data subject access	No mapping in our data	—	No mapping to CPS 234 in our data.
P5.2	Correction of personal information	No mapping in our data	—	No mapping to CPS 234 in our data.
P6.1	Disclosure to third parties with consent	No mapping in our data	—	No mapping to CPS 234 in our data.
P6.2	Record of authorized disclosures	No mapping in our data	—	No mapping to CPS 234 in our data.
P6.3	Record of unauthorized disclosures	No mapping in our data	—	No mapping to CPS 234 in our data.
P6.4	Privacy commitments from third parties	No mapping in our data	—	No mapping to CPS 234 in our data.
P6.5	Notification by third parties of unauthorized disclosures	No mapping in our data	—	No mapping to CPS 234 in our data.
P6.6	Breach notification to affected individuals	No mapping in our data	—	No mapping to CPS 234 in our data.
P6.7	Accounting of disclosures to data subjects	No mapping in our data	—	No mapping to CPS 234 in our data.
P7.1	Quality of personal information	No mapping in our data	—	No mapping to CPS 234 in our data.
P8.1	Handling privacy inquiries, complaints and disputes	No mapping in our data	—	No mapping to CPS 234 in our data.
PI1 Processing integrity · 5
PI1.1	Information about processing objectives	No mapping in our data	—	No mapping to CPS 234 in our data.
PI1.2	Controls over system inputs	No mapping in our data	—	No mapping to CPS 234 in our data.
PI1.3	Controls over system processing	No mapping in our data	—	No mapping to CPS 234 in our data.
PI1.4	Controls over system outputs	No mapping in our data	—	No mapping to CPS 234 in our data.
PI1.5	Storing inputs, items in processing and outputs	No mapping in our data	—	No mapping to CPS 234 in our data.

Check these: only loosely related (a shared CSF outcome, not a mapping) (3)

SOC 2	Requirement	Match	CPS 234	Evidence
CC6 Logical and physical access · 3
CC6.6	Protection against threats from outside system boundaries	Loosely related	Para 23	Only shares CSF DE.CM-01: related, not a mapping
CC6.7	Restricting transmission, movement and removal of information	Loosely related	Para 21	Only shares CSF PR.DS-01, PR.DS-02, PR.DS-10: related, not a mapping
CC6.8	Preventing or detecting unauthorized or malicious software	Loosely related	Para 21	Only shares CSF PR.DS-02: related, not a mapping

Mapped (24)

SOC 2	Requirement	Match	CPS 234	Evidence
C1 Confidentiality · 2
C1.1	Identifying and protecting confidential information	Editorial	Para 20	Same topic: Data Classification (editorial pick)
C1.2	Disposing of confidential information	Editorial	Para 21	Same topic: Data Protection (editorial pick)
CC1 Control environment · 4
CC1.1	Commitment to integrity and ethical values	Editorial	Para 18 Para 19	Same topic: Governance Policy (editorial pick)
CC1.2	Board independence and oversight of internal control	Editorial	Para 13 Para 14	Same topic: Roles & Responsibilities (editorial pick)
CC1.3	Structures, reporting lines, authorities and responsibilities	Editorial	Para 13 Para 14	Same topic: Roles & Responsibilities (editorial pick)
CC1.5	Accountability for internal control responsibilities	Editorial	Para 13 Para 14	Same topic: Roles & Responsibilities (editorial pick)
CC2 Communication and information · 1
CC2.3	Communication with external parties	Editorial	Para 25 Para 35 Para 36	Same topic: Communication, Reporting (editorial pick)
CC3 Risk assessment · 4
CC3.1	Objectives specified clearly enough to identify risks	Editorial	Para 13 Para 15 Para 27+1	Same topic: Risk Management (editorial pick)
CC3.2	Risk identification and analysis	Editorial	Para 17 Para 21	Same topic: Risk Assessment (editorial pick)
CC3.3	Considering the potential for fraud	Editorial	Para 17 Para 21	Same topic: Risk Assessment (editorial pick)
CC3.4	Identifying and assessing significant changes	Editorial	Para 17 Para 21	Same topic: Risk Assessment (editorial pick)
CC4 Monitoring activities · 2
CC4.1	Ongoing and/or separate evaluations of controls	Editorial	Para 32 Para 33 Para 34	Same topic: Compliance (editorial pick)
CC4.2	Communicating and remediating control deficiencies	Editorial	Para 32 Para 33 Para 34	Same topic: Compliance (editorial pick)
CC5 Control activities · 2
CC5.1	Control activities that mitigate risks	Editorial	Para 13 Para 15 Para 27+1	Same topic: Risk Management (editorial pick)
CC5.3	Control activities deployed through policies and procedures	Editorial	Para 18 Para 19	Same topic: Governance Policy (editorial pick)
CC6 Logical and physical access · 2
CC6.1	Logical access security over information assets	Editorial	Para 20	Same topic: Asset Management (editorial pick)
CC6.5	Protection of data when assets are disposed of	Editorial	Para 21	Same topic: Data Protection (editorial pick)
CC7 System operations · 5
CC7.1	Detecting configuration changes and new vulnerabilities	Editorial	Para 17 Para 27 Para 30	Same topic: Vulnerability Mgmt (editorial pick)
CC7.2	Monitoring system components for anomalies	Editorial	Para 23	Same topic: Intrusion Detection (editorial pick)
CC7.3	Evaluating security events to determine if they are incidents	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response (editorial pick)
CC7.4	Responding to identified security incidents	Editorial	Para 23 Para 24 Para 25+1	Same topic: Incident Response (editorial pick)
CC7.5	Recovering from identified security incidents	Editorial	Para 25	Same topic: Lessons Learned (editorial pick)
CC9 Risk mitigation · 2
CC9.1	Mitigating risks from business disruptions	Editorial	Para 13 Para 15 Para 27+1	Same topic: Risk Management (editorial pick)
CC9.2	Managing vendor and business partner risk	Editorial	Para 16 Para 22 Para 28+1	Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick)

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.

SOC 2 vs CPS 234

Have SOC 2 → need CPS 234

Have CPS 234 → need SOC 2

By topic