How to implement CPS 234: A 7-step compliance guide

Security is no longer just an internal concern for Australian organisations. Vanta’s 2025 State of Trust Report found that 75% of Australian respondents say stakeholders now expect verified proof of security and compliance, up from 62% in 2024. For APRA-regulated entities, CPS 234 puts that expectation into practice by requiring them to maintain information security capabilities that match their risk profile.

‍

CPS 234 takes a broad, risk-based approach to information security, which can make the standard challenging to implement in practice as risks evolve. This guide breaks down the key APRA CPS 234 compliance requirements, explains how the standard fits with related standards like CPS 230, and walks through a seven-step plan for putting CPS 234 into practice.

‍

What is CPS 234?

Prudential Standard CPS 234 (Information Security), issued by the Australian Prudential Regulation Authority (APRA), mandates specific cyber resilience requirements for all APRA-regulated entities and has been effective since 1 July 2019.

‍

CPS 234 was introduced to address the growing frequency and complexity of cyber threats. Organisations in the finance and insurance sectors, which APRA governs, are particularly vulnerable to such threats. With CPS 234 controls, regulated entities can strengthen their cyber resilience and protect their information assets against:

‍

• External security attacks
• Breaches and sensitive data leaks
• Security concerns caused by internal negligence

‍

CPS 234 covers the entity’s own information assets as well as those managed by third parties.

‍

{{cta_withimage40="/cta-blocks"}}

‍

CPS 230 vs CPS 234: What’s the difference?

CPS 230 Operational Risk Management is another prudential standard issued by APRA. Like CPS 234, CPS 230 applies to all APRA-regulated entities, helping them maintain continuity of critical operations during disruptions. CPS 230 consolidated and replaced five other standards covering the underlying themes. Here’s how CPS 230 and CPS 234 compare:

‍

‍

There’s a common misconception that CPS 230 replaced CPS 234. In reality, the two standards are complementary and APRA-regulated entities should comply with both. However, they overlap in two key areas:

‍

1. Third-party risk management: CPS 234 requires entities to assess the information security capabilities of third parties managing their information assets, while CPS 230 introduces broader requirements for managing risks around material service providers. Entities frequently keep two parallel TPRM workstreams—one “CPS 234 security questionnaire” track and one “CPS 230 material service provider” track—when APRA actually expects a single integrated program with shared due diligence, contractual, and monitoring goals.
2. Incident management: CPS 234 requires entities to notify APRA of material information security incidents, while CPS 230 introduces broader notification requirements for operational risk incidents that could have a material financial impact or materially affect critical operations. The requirements can overlap, but APRA clarifies that it doesn't require entities to report the same security incident separately under CPS 230.

‍

{{cta_webinar14="/cta-blocks"}}

‍

Who needs CPS 234 compliance?

CPS 234 applies to all APRA-regulated entities, including:

‍

• Authorised deposit-taking institutions (ADIs)
• General insurers
• Life companies
• Private health insurers registered under the Private Health Insurance (Prudential Supervision) PHIPS Act
• Registrable Superannuation Entities (RSE), licensees under the Superannuation Industry (Supervision) SIS Act

‍

Applicability is clearly defined, which makes it easy to understand how CPS 234 affects your organisation and ensure it meets all the necessary obligations. If you work with third parties that can access in-scope information assets, the standard’s requirements extend to all of them, including organisations outside of Australia.

‍

How CPS 234 applies to third parties and international vendors

Third parties, including those outside Australia, are not directly subject to CPS 234. However, APRA-regulated entities may still use contractual obligations to require their third parties to demonstrate controls aligned with the standard.

‍

Examples of such organisations include:

‍

• A U.S.-based fintech offering cloud-based lending platforms to Australian banks
• A U.S.-based data analytics provider processing superannuation data
• A cybersecurity vendor monitoring Australian insurer infrastructure remotely

‍

In any of the above cases (and other scenarios involving foreign data storage), organisations must evaluate the underlying risks and implement the necessary CPS 234 controls.

‍

Doing so might be particularly challenging for organisations governed by the Clarifying Lawful Overseas Use of Data (CLOUD) Act. While it doesn’t ​​directly contradict CPS 234, it can cause a potential conflict for Australian entities using cloud services from U.S.-based providers.

‍

The CLOUD Act allows U.S. law enforcement, subject to legal process, to compel U.S.-based providers to produce data in their possession, custody, or control regardless of where that data is stored. As such, Australian organisations should consider the potential implications of their CPS 234 obligations when choosing, contracting with, and monitoring cloud service providers.

‍

Because you have limited control over third parties’ security postures, you should enforce CPS 234 security requirements through contracts and legal agreements and hold vendors accountable for meeting them.

‍

When defining these requirements, consider the types of data the vendor will handle. Then, assess the impact of a potential security incident on your organisation or product operations. Use this assessment to inform the vendor’s risk severity and appropriate level of oversight and security requirements.

‍

{{cta_withimage20="/cta-blocks"}} | Vendor Risk checklist

‍

APRA CPS 234 requirements and controls

CPS 234 outlines nine core requirement areas that in-scope organisations need to focus on:

‍

1. Roles and responsibilities
2. Information security capability
3. Policy framework
4. Information assets identification and classification
5. Implementation of information security controls
6. Incident management
7. Testing control effectiveness
8. Internal audit
9. APRA notification

‍

CPS 234 information security requirements don’t outright prescribe specific controls: organisations determine appropriate information security measures based on their own risk evaluations and business needs.

‍

To standardise the process, APRA published the Prudential Practice Guide CPG 234 (Information Security). This implementation guide provides organisations with additional context for each requirement area and applicable controls. Don’t treat CPG 234 as a checklist, though. The guide’s listed examples aren't mandatory, but serve as reference benchmarks so you can design your risk-based controls and remediation measures appropriately.

‍

The practices listed in CPS 234 and CPG 234 overlap with other frameworks and regulations common in Australia, including ISO 27001, SOC 2, and GDPR. You can reuse your existing implementations where applicable to accelerate compliance.

‍

Bonus: Read our CPS 234 vs ISO 27001 guide to scope their overlaps.

‍

CPS 234 penetration testing requirements for controls

CPS 234 expects organisations to conduct regular tests to validate their controls are working as intended. Penetration testing is one of the main methods APRA mentions for assessing control effectiveness and identifying potential weaknesses in your security posture.

‍

While APRA doesn’t require testing at a set frequency, it does expect organisations to conduct it regularly at intervals appropriate for their risk profile. As a best practice, penetration tests should be performed at least annually to address security gaps between audits. Engage individuals with the appropriate skills and experience for testing. Your testers should have “sufficient independence” from the controls they’re validating, depending on the scope, nature, and importance of the validation.

‍

“CPG 234 ties the skills and independence required for testing to the criticality of the asset.

‘Independent’ means the tester is functionally separate from those who designed, implemented, or operate the control, which typically means using an external specialist for material controls.

‘Skilled’ means having current, demonstrable expertise in the technology and threat domain being tested, whether that’s cloud, application security, identity, or AI/ML, rather than a generic IT audit qualification.

The more critical the asset, the stronger the case for specialised expertise and independence, and APRA expects entities to be able to justify their choice of tester.”

Evan Rowse

GTM GRC SME, Vanta

|

LinkedIn

‍

How to comply with CPS 234: Key steps to follow

You can achieve CPS 234 compliance and manage your business risk by taking these steps:

‍

1. Establish roles and responsibilities
2. Develop and maintain information security capabilities
3. Establish a comprehensive policy framework
4. Identify and classify information assets
5. Implement robust controls
6. Develop incident management procedures
7. Perform regular internal audits‍

‍

Step 1: Establish roles and responsibilities

Section 14 of CPS 234 requires clearly defined roles and responsibilities for the Board, senior management, IT staff, and other relevant personnel. Still, accountability for the organisation’s information security ultimately rests with the Board.

‍

For smooth compliance operations, get the buy-in of high-level executives before developing your CPS 234 implementation strategy. They must understand their responsibilities, the consequences of non-compliance, and their role in maintaining cyber resilience.

‍

The Board must implement and maintain security controls corresponding to information security threats. This implies that you must first understand your threat landscape through security reviews and risk assessments.

‍

To streamline the process, establish dedicated committees like the information security steering committee and risk management committee. They should conduct the necessary assessments and advise the Board on applicable controls.

‍

Step 2: Develop and maintain information security capabilities

After understanding your organisation’s risk profile and security landscape, perform a comprehensive assessment of the existing security capabilities to identify compliance gaps. Review your policies, processes, and procedures to identify weaknesses and prioritise remediation based on urgency.

‍

CPS 234 requires organisations to extend this oversight to all third parties managing their information assets, including:

‍

• Cloud providers
• Payment processors
• SaaS platforms with access to sensitive data

‍

Once you’ve performed the necessary assessments, use the results to establish and oversee capabilities in areas like:

‍

• Vulnerability and threat management
• Situational awareness
• Secure design
• Incident response

‍

Step 3: Establish a comprehensive policy framework

CPS 234 requires organisations to build and maintain an information security policy proportional to relevant threats and risk exposure of their environment. Much like security controls, this policy must be aligned with the organisation’s threat landscape and the potential impact of those threats on operational stability.

‍

The policy should cover relevant security procedures and measures, such as:

‍

• Access controls
• Hardware and software protection
• Configuration management
• Third-party risk management

‍

As your organisation’s security evolves continuously, your implemented CPS 234 controls shouldn’t remain static. Instead, set up regular reviews and assessments of the current threat landscape to adapt your policies accordingly.

‍

Organisation-wide security awareness is crucial to effective implementation, so communicate the policies to relevant team members at all levels. You should also set up adequate training initiatives that demonstrate security policies in real-life settings to help your team apply policy principles in their daily work.

‍

Step 4: Identify and classify information assets

To effectively protect information assets, inventory and classify them according to their criticality and sensitivity. This applies to internal assets as well as those managed by third parties, which require particular attention due to the expanded threat landscape.

‍

“Most entities under-invest in asset identification and classification, and it quietly undermines everything downstream. CPS 234 paragraph 20 requires you to classify information assets by criticality and sensitivity—including those managed by third parties—but in practice, I see static spreadsheets that haven’t been refreshed in 18 months. Without an accurate, current asset register, your control sizing, testing scope, and incident triage are all working off the wrong inputs.”

Evan Rowse

GTM GRC SME, Vanta

|

LinkedIn

‍

CPS 234 Section 21 requires organisations to implement controls based on the vulnerabilities and threats to their information assets, their criticality and sensitivity, their lifecycle stage, and the potential consequences of an information security incident. This impact doesn’t only encompass the organisation itself but also the key stakeholders, most notably:

‍

• Policy holders
• Depositors
• Beneficiaries
• Other customers

‍

As your security landscape changes, revisit and reclassify assets if needed. Besides regular reviews, make sure to conduct reassessments after the following scenarios:

‍

• Realised security threats
• Onboarding/offboarding new vendors with access to information assets
• Notable changes to the IT infrastructure

‍

Tip: Keep your asset register up to date automatically with the help of leading risk management platforms like Vanta. It continuously updates connected records as your environment changes, giving an accurate view of your information assets and risks without the burden of maintaining static spreadsheets or making manual updates.

‍

Step 5: Implement robust controls

CPS 234 requires organisations to develop and enforce security controls that correspond to:

‍

• An information asset’s vulnerabilities and threats
• Criticality and sensitivity
• The lifecycle stage of the information asset
• Potential consequences of a security incident

‍

Regardless of your specific workflows, a recommended best practice is to implement these controls across your development, testing, and production environments, as threats can arise in each.

‍

As security controls of third parties directly impact your security posture, CPS 234 requires organisations to review them. If you notice any deficiencies, you can correct them by updating the contract terms to enforce specific controls.

‍

Your security controls must evolve with the changes in your risk profile and security landscape, so review them regularly to see if any adjustments are needed. You can use today’s top compliance automation solutions for ongoing oversight and gap remediation with the help of integrations.

‍

Step 6: Develop incident management procedures

As per Sections 23–25 of CPS 234, organisations must develop effective procedures for detecting and responding to security incidents. While CPS 234 does not prescribe a specific process, industry best practices—such as those from NIST and SANS—recommend covering the following stages:

‍

1. Detection
2. Analysis
3. Containment
4. Eradication
5. Recovery
6. Post-incident review

‍

‍The specifics of your procedures will depend on your workflows and IT infrastructure, but they must all serve a single goal—responding to incidents swiftly and with minimal damage.

‍

Also, develop clear procedures for escalating and reporting incidents to the Board and other relevant stakeholders. For this, you need effective communication channels throughout the organisation and defined reporting responsibilities. Create and regularly test continuity, disaster recovery, and incident response plans. These plans should outline how your organisation prepares for, responds to, and recovers from security incidents while minimising disruptions to key operations.

‍

“The timelines to report incidents are strict. Building an incident response plan, which includes reporting to APRA, will help you predefine what constitutes a material incident and who on your team should make the final call. It’s a valuable resource when handling security incidents.”

Evan Rowse

GTM GRC SME, Vanta

|

LinkedIn

‍

If an incident happens, you must notify APRA within 72 hours of becoming aware of a material information security incident. You must also notify APRA within 10 business days of becoming aware of a material information security control weakness that might not be remediated in a timely manner. This requires clear external notification procedures alongside effective internal communication and escalation processes.

‍

Step 7: Perform regular internal audits

There’s no formal CPS 234 compliance process, and APRA doesn’t award any explicit certifications. Instead, you must self-assess your security posture against its requirements and bridge any gaps effectively.

‍

As there are also no recertifications, it’s on you to maintain your controls indefinitely for ongoing compliance. This calls for an effective internal audit process that lets you regularly review the design and operating effectiveness of information security controls.

‍

“Unless an internal audit is already in place, creating and managing one program to effectively review and measure compliance can be challenging to incorporate into an organisation’s broader information security program.”

Faisal Khan

GRC Solutions Expert, Vanta

|

LinkedIn

‍

APRA can challenge your self-attestation at any time and conduct reviews to validate your controls. The supervisory mechanism for this review is a tripartite review program, which entails assessments from:

‍

• The regulated entity’s internal audit function
• An independent external auditor
• APRA

‍

The independent audit assesses controls against 21 control objectives mapped to CPS 234 requirements. The findings provide APRA with independent assurance of an organisation’s risk management practices satisfying compliance criteria.

‍

Why Vanta is the best CPS 234 compliance software

Vanta is the leading agentic trust management platform that automates the compliance workflows for over 40 major frameworks and regulations, including CPS 234. Powered by agentic AI, built-in compliance resources and workflows, and continuous oversight, the platform helps you maintain CPS 234 compliance readiness while minimising the busywork around collecting evidence and preparing for audits.

‍

Vanta’s out-of-the-box CPS 234 solution streamlines compliance through tailored features, notably:

‍

• 1,400+ automated tests that monitor controls hourly
• Pre-configured document templates and policies
• Continuous visibility of your CPS 234 compliance readiness
• Automated evidence collection through over 400+ integrations
• Framework mapping to reuse evidence of existing controls
• Access to a network of accredited auditors for support and remediation

‍

As vendor oversight is a major part of CPS 234 compliance, you can also try Vanta’s agentic third-party risk management product to continuously monitor whether your third parties adhere to CPS 234.

‍

Schedule a custom demo of Vanta’s CPS 234 product for an in-depth walkthrough.

‍

{{cta_simple37="/cta-blocks"}} | CPS 234 demo

‍

FAQs

What are CPS 234 non-compliance penalties?

‍The fine for non-compliance is not explicitly stated in the CPS 234 itself. Instead, penalties are determined under the broader acts relevant for the entity, for example, the Banking Act, Insurance Act, Life Insurance Act, and Superannuation Industry (Supervision) Act. Depending on the type of regulated entity, penalties can include enforceable undertakings, directions, or, in serious cases, civil or criminal proceedings.

‍

‍Your business could also suffer additional issues like:

‍

• Legal escalations
• Loss of business
• Reputational damage

‍

Given APRA’s increased supervisory attention on cyber resilience, regulated entities should expect greater scrutiny and proactive enforcement of CPS 234 requirements.

‍

Do you need Essential Eight to align with CPS 234?

CPS 234 compliance doesn’t require alignment with Essential Eight, since it’s not a mandatory framework for most APRA-regulated entities. However, APRA has identified the E8 as a useful reference framework to strengthen its information security capabilities, particularly for practices such as daily backups, multi-factor authentication, and application patching.

‍

How quickly must you report an incident to APRA under CPS 234?

APRA-regulated entities must report material security incidents to APRA within 72 hours of becoming aware of them. They must notify APRA within 10 business days of becoming aware of a material information security control weakness that the entity expects it will not be able to remediate in a timely manner.

‍

Does CPS 234 apply to third parties and overseas vendors?

CPS 234 applies to a regulated entity’s information assets, including those managed by third parties. Although overhead vendors aren't directly bound by CPS 234, covered entities remain responsible for ensuring they maintain appropriate information security controls, typically through due diligence, contractual requirements, and ongoing oversight.

‍

Does CPS 230 replace CPS 234?

No, CPS 230 doesn’t replace CPS 234. They are complementary standards, where CPS 234 is the governing prudential standard for information security, while CPS 230 establishes broader operational risk management requirements.

‍

How is CPS 234 different from ISO 27001?

CPS 234 is a mandatory Australian prudential standard issued by APRA, while ISO 27001 is a voluntary international standard for maintaining an information security management system (ISMS). While the two overlap in some areas, CPS 234 includes APRA-specific guidance, reporting requirements, and board accountability.

‍

Will CPS 234 change to address AI risks?

APRA hasn’t announced CPS 234 changes that specifically address AI, but it has increased its focus on AI risk. In its April 30th, 2026 letter, APRA emphasised that organisations should extend their control register to specifically cover AI systems, update AI vendor contracts against CPS 230 requirements, build controls that account for non-human identities, and give boards AI risk briefings independent of vendor presentations.