Framework

APRA CPS 234 Information Security

What it is

A legally binding prudential standard from the Australian Prudential Regulation Authority (APRA), in force since 1 July 2019. It is principles-based: 24 operative paragraphs on Board responsibility, information security capability, policy, asset classification, controls, incident management, control testing, internal audit and notifying APRA. APRA's guide CPG 234 describes better practice but is not binding.

Who needs it

Every APRA-regulated entity: authorised deposit-taking institutions (banks, credit unions and building societies), general, life and private health insurers, and RSE licensees (superannuation trustees). Its requirements reach the related parties and third parties that manage their information assets.

How it's assessed

There is no certification; APRA supervises compliance. Entities must notify APRA within 72 hours of becoming aware of a material information security incident, and within 10 business days of a material control weakness they can't remediate in time. Business continuity and service providers are covered separately by CPS 230 Operational Risk Management, in force since 1 July 2025.

Paragraphs

Mapped to another framework

34%

Topics covered (17/50)

Gap analysis → CPS 234 From CPS 234 →

Counts: the operative paragraphs 13 to 36.

CPS 234 is principles-based: it requires controls commensurate with threats without naming them, so most technical topics show no link. APRA's guide CPG 234 names specific practices but is not binding and not mapped. All links are editorial.

Requirements

APRA CPS 234 Information Security requirements
ID	Requirement	Topics	Mapped in
Roles and responsibilities · 2
Para 13	Board ultimately responsible for information security	Risk Management, Roles & Responsibilities	10 of 13
Para 14	Define information security roles and responsibilities	Roles & Responsibilities	9 of 13
Information security capability · 3
Para 15	Maintain a capability commensurate with threats	Risk Management	10 of 13
Para 16	Assess third parties' information security capability	Supply Chain Risk, Vendor Risk Mgmt	10 of 13
Para 17	Keep capability current as threats and vulnerabilities change	Risk Assessment, Vulnerability Mgmt, Threat Intelligence	13 of 13
Policy framework · 2
Para 18	Maintain an information security policy framework	Governance Policy	9 of 13
Para 19	Policies direct everyone with security obligations	Governance Policy	9 of 13
Information asset identification and classification · 1
Para 20	Classify information assets by criticality and sensitivity	Asset Management, Data Classification	13 of 13
Implementation of controls · 2
Para 21	Timely controls commensurate with risk and asset life-cycle	Risk Assessment, Data Protection	11 of 13
Para 22	Evaluate the design of third parties' controls	Supply Chain Risk, Vendor Risk Mgmt	10 of 13
Incident management · 4
Para 23	Detect and respond to incidents in a timely manner	Intrusion Detection, Incident Response	12 of 13
Para 24	Maintain information security response plans	Incident Response	12 of 13
Para 25	Response plans cover all stages and escalation	Incident Response, Communication, Lessons Learned	12 of 13
Para 26	Review and test response plans annually	Incident Response	12 of 13
Testing control effectiveness · 5
Para 27	Systematic testing programme for control effectiveness	Risk Management, Vulnerability Mgmt	13 of 13
Para 28	Check third parties' control testing is adequate	Vendor Risk Mgmt	10 of 13
Para 29	Escalate deficiencies that can't be fixed quickly	—	none
Para 30	Testing by skilled, functionally independent specialists	Vulnerability Mgmt	13 of 13
Para 31	Review the testing programme at least annually	Risk Management	10 of 13
Internal audit · 3
Para 32	Internal audit reviews control design and effectiveness	Compliance	10 of 13
Para 33	Assurance provided by appropriately skilled personnel	Compliance	10 of 13
Para 34	Internal audit assesses third-party assurance relied on	Compliance, Vendor Risk Mgmt	11 of 13
APRA notification · 2
Para 35	Notify APRA of material incidents within 72 hours	Reporting	12 of 13
Para 36	Notify APRA of material control weaknesses within 10 business days	Reporting	12 of 13

Topic coverage

Topics with mapped CPS 234 requirements (17):

Governance Policy Risk Management Supply Chain Risk Roles & Responsibilities Compliance Asset Management Risk Assessment Data Classification Vulnerability Mgmt Threat Intelligence Data Protection Intrusion Detection Incident Response Communication Reporting Lessons Learned Vendor Risk Mgmt

No mapping in our data No CPS 234 requirement (33):