CPS 234 addresses virtually all aspects of an entity’s security infrastructure, so implementation can be challenging without guidance. To give you a starting point, this article will cover: The meaning and purpose of CPS 234
An overview of the framework’s structure
Actionable implementation steps The meaning and purpose of CPS 234 An overview of the framework’s structure Actionable implementation steps What is CPS 234? CPS 234 is a prudential standard issued by APRA that mandates cyber resilience requirements for regulated entities. It came into effect in 2019 as the Authority’s response to the increasing number and sophistication of cybersecurity threats. Organisations in the finance and insurance sectors are particularly susceptible to such threats, so APRA enforces strict requirements through CPS 234 to help them improve their security posture and reduce various risks, most notably: security posture External security attacks
Breaches and leaks of sensitive data
Security concerns caused by the internal teams’ negligence External security attacks Breaches and leaks of sensitive data Security concerns caused by the internal teams’ negligence Where does CPS 234 fit in with other CPS standards? CPS 234 is a standalone standard that complements CPS 230, which broadly covers operational risk, including technology risk. CPS 230 came into force on 1 July 2025 and replaced five other standards, specifically CPS 231 (Outsourcing), SPS 231 (Outsourcing), HPS 231 (Outsourcing), CPS 232 (Business Continuity Management), and SPS 232 (Business Continuity Management). Who needs CPS 234 compliance? CPS 234 outlines five categories of entities that must achieve compliance with the standard: Authorised deposit-taking institutions (ADIs)
General insurers
Life companies
Private health insurers registered under the Private Health Insurance (Prudential Supervision) PHIPS Act
Registrable Superannuation Entities (RSE), licensees under the Superannuation Industry (Supervision) SIS Act Authorised deposit-taking institutions (ADIs) General insurers Life companies Private health insurers registered under the Private Health Insurance (Prudential Supervision) PHIPS Act Registrable Superannuation Entities (RSE), licensees under the Superannuation Industry (Supervision) SIS Act ‍ Applicability is clearly defined, which makes it easy to understand how CPS 234 affects your organisation and ensure it meets all the necessary obligations. If you work with third parties that can access in-scope sensitive data, the framework’s requirements extend to all of them, including organisations outside of Australia. third parties How CPS 234 applies to third parties and international vendors Third parties, including those outside Australia, are not directly subject to CPS 234 but may be contractually required to demonstrate control effectiveness aligned with CPS 234, as determined by the APRA-regulated entity they serve. Examples of such organisations include: A U.S.-based fintech offering cloud-based lending platforms to Australian banks
A U.S.-based data analytics provider processing superannuation data
A cybersecurity vendor monitoring Australian insurer infrastructure remotely A U.S.-based fintech offering cloud-based lending platforms to Australian banks A U.S.-based data analytics provider processing superannuation data A cybersecurity vendor monitoring Australian insurer infrastructure remotely In any of the above cases (and other scenarios involving foreign data storage), organisations must check and implement the necessary controls aligned with CPS 234. Doing so might be particularly challenging for organisations governed by the Clarifying Lawful Overseas Use of Data (CLOUD) Act. While it doesn’t ​​directly contradict CPS 234, it might cause a potential conflict for Australian entities using cloud services from U.S.-based providers. The CLOUD Act allows U.S. law enforcement access to data held by U.S.-based providers, even when that data is stored overseas. As such, Australian organisations using these services must ensure CPS 234’s confidentiality and sovereignty requirements are not compromised. This involves a careful balance between CPS 234 and CLOUD Act compliance. As you don’t have much control over third parties’ security postures, as a regulated entity you should enforce CPS 234 compliance through legal agreements and contract terms that specify the standard’s implementation. To outline all the necessary terms, consider the types of data you’ll be storing with the vendor. You should then assess the impact of a potential incident on your organisation or product operations to inform the risk severity of that vendor. CPS 234 controls CPS 234 outlines nine core requirement areas, each of which implies a set of control expectations that organisations must implement based on their risk environment: Roles and responsibilities
Information security capability
Policy framework
Information assets identification and classification
Implementation of information security controls
Incident management
Testing control effectiveness
Internal audit
APRA notification Roles and responsibilities Information security capability Policy framework Information assets identification and classification Implementation of information security controls Incident management Testing control effectiveness Internal audit APRA notification ‍ The requirements are clear and prescriptive, and they’re designed to achieve the framework’s key objectives: Clearly defining the security-related roles and responsibilities
Maintaining a robust information security capability corresponding with data criticality and sensitivity
Implementing adequate controls to protect the organisation’s information assets
Notifying APRA of relevant security incidents Clearly defining the security-related roles and responsibilities Maintaining a robust information security capability corresponding with data criticality and sensitivity Implementing adequate controls to protect the organisation’s information assets Notifying APRA of relevant security incidents ‍ Besides clarity, a notable advantage of CPS 234 requirements is their close relationship with ISO 27001 controls. If you’ve already fully adopted ISO 27001, you should achieve CPS 234 compliance more efficiently through effective control mapping. ISO 27001 controls ‍ CPS 234 non-compliance penalties Given APRA’s increased supervisory attention on cyber resilience, regulated entities should expect greater scrutiny and more proactive enforcement of CPS 234 requirements. The fine for non-compliance is not explicitly stated in the CPS 234 itself. Instead, penalties are determined under the broader acts relevant for the entity, for example Banking Act, Insurance Act, Life Insurance Act, and Superannuation Industry (Supervision) Act. Depending on the type of regulated entity, penalties can include enforceable undertakings, directions, or, in serious cases, civil or criminal proceedings. Your business could also suffer additional issues like: Legal escalations
Loss of business
Reputational damage Legal escalations Loss of business Reputational damage ‍ 7 steps to CPS 234 compliance Regardless of the applicability category your organisation falls into, you can achieve CPS 234 compliance and manage your business risk by taking these steps: Establish roles and responsibilities
Develop and maintain information security capability
Establish a comprehensive policy framework
Identify and classify information assets
Implement robust controls
Develop incident management procedures
Perform regular internal audits Establish roles and responsibilities Develop and maintain information security capability Establish a comprehensive policy framework Identify and classify information assets Implement robust controls Develop incident management procedures Perform regular internal audits ‍ The following sections will outline each step with the key action items. Step 1: Establish roles and responsibilities Section 13 of CPS 234 requires clearly defined roles and responsibilities of the Board, senior management, IT staff, and other relevant personnel. Still, the main focus remains on the Board, which is ultimately responsible for the organisation’s information security. That’s why it’s crucial to get the buy-in of high-level executives before developing the CPS 234 implementation strategy. They must understand their responsibilities and the consequences of any violations. As per Section 13, the Board must implement and maintain security controls corresponding to information security threats. This implies that you must first understand your threat landscape by conducting the necessary security reviews and risk assessments. security reviews To streamline the process, you can develop dedicated committees like the information security steering committee and risk management committee. They should conduct the necessary assessments and advise the Board on the controls that must be implemented. Step 2: Develop and maintain information security capability After understanding your organisation’s risk profile and security landscape, perform a comprehensive assessment of the existing security capabilities to identify compliance gaps. Review your policies, processes, and procedures to highlight weak spots and prioritise them according to urgency. CPS 234 requires organisations to extend this process to all third parties managing their information assets, including: Cloud providers
Payment processors
SaaS platforms with access to sensitive data Cloud providers Payment processors SaaS platforms with access to sensitive data ‍ Once you’ve performed the necessary assessments, use the results to establish and oversee capabilities in areas like: Vulnerability and threat management
Situational awareness
Secure design
Incident responses Vulnerability and threat management Situational awareness Secure design Incident responses ‍ Step 3: Establish a comprehensive policy framework CPS 234 requires organisations to build and maintain an information security policy proportional to relevant threats and risk exposure of their environment. Much like security controls, this policy (Section 18) must be aligned with the extent of the security threats and their impact on the organisation’s operational stability. ‍ The policy should encompass all the relevant security procedures and measures, such as: Access controls
Hardware and software protection
Configuration management
Third-party risk management Access controls Hardware and software protection Configuration management Third-party risk management Third-party risk management ‍ As your organisation’s security evolves continuously, your implemented CPS 234 controls shouldn’t remain static. Instead, set up regular reviews and assessments of the current threat landscape to adapt your policies accordingly. Organisation-wide security awareness is crucial to effective implementation, so communicate the policies to relevant team members at all levels. You should also set up adequate training initiatives that demonstrate security policies in real-life settings to help your team apply policy principles in their daily work. Step 4: Identify and classify information assets To effectively protect information assets, you must inventory and classify them according to their criticality and sensitivity. This applies to internal assets as well as those managed by third parties, which you should pay particular attention to due to the expanded threat landscape. CPS 234 Section 20 requires organisations to implement controls based on the classification of  assets according to a potential incident's financial or non-financial impact. This impact doesn’t only encompass the organisation itself but also the key stakeholders, most notably: Policyholders
Depositors
Beneficiaries
Other customers Policyholders Depositors Beneficiaries Other customers ‍ As your security landscape changes, you must revisit and reclassify assets if needed. Besides regular reviews, make sure to conduct reassessments after the following scenarios: Realised security threats
Onboarding/offboarding new vendors with access to information assets
Notable changes to the IT infrastructure Realised security threats Onboarding/offboarding new vendors with access to information assets Notable changes to the IT infrastructure ‍ Step 5: Implement robust controls CPS 234 requires organisations to develop and enforce security controls that correspond to: An information asset’s vulnerabilities and threats
Criticality and sensitivity
The lifecycle stage of the information asset
Potential consequences of a security incident An information asset’s vulnerabilities and threats Criticality and sensitivity The lifecycle stage of the information asset Potential consequences of a security incident ‍ Regardless of your specific workflows, a recommended best practice is to implement these controls across your development, testing, and production environments because threats can arise in each. As security controls of your third parties directly impact your security posture, CPS 234 requires organisations to review them. If you notice any deficiencies, you can correct them by adjusting the contract terms to enforce specific controls. Your security controls must keep up with the changes in your risk profile and security landscape, so review them regularly to see if any adjustments are needed. Step 6: Develop incident management procedures As per Sections 23-25 of CPS 234, organisations must develop effective procedures for detecting and responding to security incidents. While CPS 234 does not prescribe a specific process, industry best practices—such as those from NIST and SANS—recommend covering the following six stages: Detection
Analysis
Containment
Eradication
Recovery
Post-incident review Detection Analysis Containment Eradication Recovery Post-incident review ‍ The specifics of your procedures will depend on your workflows and IT infrastructure, but they must all serve a single goal—responding to incidents swiftly and with minimal damage. You also need to develop clear procedures for escalating and reporting incidents to the Board and other relevant stakeholders. This will require you to have effective communication channels throughout the organisation and clearly defined reporting responsibilities. If an incident happens, you must notify APRA within 72 hours and provide notifications of control weaknesses that can result in an incident within 10 business days. This means that you need a clear external notification process, in addition to effective internal communication channels you may have.‍ “The timelines to report incidents are strict. Building an Incident Response Plan, which includes reporting to APRA, will help you predefine what constitutes a material incident and who on your team should make the final call. It’s a valuable resource when handling security incidents.”
Evan RowseGRC Subject Matter Expert, Vanta |  LinkedIn “The timelines to report incidents are strict. Building an Incident Response Plan, which includes reporting to APRA, will help you predefine what constitutes a material incident and who on your team should make the final call. It’s a valuable resource when handling security incidents.” Evan Rowse GRC Subject Matter Expert, Vanta |  LinkedIn LinkedIn CPS 234 Section 26 requires organisations to review their incident response procedures annually to ensure ongoing effectiveness. Besides the related policy reviews, you should set up simulations to ensure the procedures stay effective in real-life settings. Step 7: Perform regular internal audits There’s no formal CPS 234 compliance process, and APRA doesn’t award any explicit certifications. Instead, you must self-assess your security posture against its requirements and bridge any gaps effectively. As there are also no recertifications, you must maintain your controls indefinitely to ensure ongoing compliance. This calls for an effective internal audit process that lets you regularly audit the design and operating effectiveness of information security controls. internal audit process This is often one of the most challenging aspects of CPS 234 compliance for in-scope organisations. If you don’t have well-defined audit procedures, this could result in non-compliance with CPS 234 obligations. ‍ “Unless an internal audit is already in place, creating and managing one program to effectively review and measure compliance can be challenging to incorporate into an organisation’s broader information security program.”
Faisal KhanGRC Solutions Expert, Vanta | LinkedIn “Unless an internal audit is already in place, creating and managing one program to effectively review and measure compliance can be challenging to incorporate into an organisation’s broader information security program.” Faisal Khan GRC Solutions Expert, Vanta | LinkedIn LinkedIn The good news is that there are several ways to overcome these obstacles. A common solution is to combine independent reviews and expert opinions with internal audit activities, especially in areas requiring specialised knowledge. Another way to streamline ongoing CPS 234 compliance is by using a dedicated software solution. With the right platform, you can remove manual work from the process and maintain your controls more efficiently. Achieve and maintain CPS 234 compliance with Vanta Vanta is a comprehensive trust and compliance management platform that automates the compliance workflows related to over 35 major frameworks and regulations, including CPS 234. 35 major frameworks and regulations It offers a dedicated CPS 234 product that streamlines compliance through various features, most notably: Pre-configured document templates and policies


Continuous visibility of your CPS 234 compliance status


Automation and integration options for evidence collection and controls monitoring through over [integrations_count] integrations


Access to a network of accredited auditors for support and remediation throughout the compliance process Pre-configured document templates and policies Pre-configured document templates and policies Continuous visibility of your CPS 234 compliance status Continuous visibility of your CPS 234 compliance status Automation and integration options for evidence collection and controls monitoring through over [integrations_count] integrations Automation and integration options for evidence collection and controls monitoring through over [integrations_count] integrations over [integrations_count] integrations Access to a network of accredited auditors for support and remediation throughout the compliance process Access to a network of accredited auditors for support and remediation throughout the compliance process As third-party risk management is a major part of CPS 234 compliance, Vanta also offers a robust Vendor Risk Management solution to help you continuously oversee the security posture of your third parties and ensure adherence to CPS 234. Vendor Risk Management solution Besides dedicated products for the major CPS 234 compliance aspects, Vanta provides ongoing expert support at any stage of the process to eliminate guesswork and minimise the risk of violations. Schedule a custom demo of Vanta’s CPS 234 product to learn how it helps you achieve and maintain compliance. Schedule a custom demo

An Actionable CPS 234 Implementation Guide

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

A Guide to HIPAA Compliance for Software Development

Reducing Privacy Code Review Overhead With Privacy-Relevant Methods

Automating Privacy Code Reviews by Mapping How Software Handles Personal Data

Tracing Personal Data Through APIs

How Static Analysis Can Expose Personal Data Hidden in Source Code

Data-Driven Ranking Reveals Where Privacy Risks Actually Live in Java and JavaScript Code

A Guide to HIPAA Compliance for Software Development

Reducing Privacy Code Review Overhead With Privacy-Relevant Methods

Automating Privacy Code Reviews by Mapping How Software Handles Personal Data

Tracing Personal Data Through APIs

How Static Analysis Can Expose Personal Data Hidden in Source Code

Data-Driven Ranking Reveals Where Privacy Risks Actually Live in Java and JavaScript Code

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps