Australia · Australian Prudential Regulation Authority (APRA) · CPS 234

APRA Prudential Standard
CPS 234

APRA's information-security standard: regulated entities must match their security capability to the threats they face.

What it is

CPS 234 applies to all APRA-regulated entities - banks, insurers, superannuation trustees and other RSE licensees. It sets five core obligations: clear roles and responsibilities; security capability that matches the threats; controls to protect information assets; testing those controls; and notifying APRA within 72 hours about material information-security incidents. Boards are ultimately accountable for information security under the standard.

Who it applies to

All APRA-regulated entities, including ADIs, foreign ADIs, general insurers, life insurers, private health insurers, superannuation trustees and RSE licensees.

APRA Prudential Standard CPS 234

A structured path to CPS 234 compliance.

The standard asks each entity to keep its controls in step with the threats it faces. As you grow, or as threats rise, you must act to cut the risk. Whatever your size, you need the right processes in place. We find where you stand and take you through to ongoing assurance.

Assess

CPS 234 assessment

We measure your entity against each area of the standard and show where you fall short.

Audit

CPS 234 audit

We audit your controls and the evidence behind them, as APRA would expect to see.

Plan

Risk management plan

We set out the risks we found and the order in which to fix them. Where there are gaps, we help you remediate them.

Comply

Achieve compliance

We work with your team until each requirement of the standard is met.

Assure

Ongoing monitoring and assurance

We keep checking your controls so you stay compliant as your business and the threats change.

Your data stays on home soil.

Vectra is based in Australia. Our offices in Brisbane, Melbourne, Sydney, Adelaide and Perth handle CPS 234 assessments, audits and remediation.

Talk to us about CPS 234

The nine areas the standard covers.

Roles and responsibilities

Define information-security roles clearly, including the board, senior management, governing bodies and individuals.

Information-security capability

Maintain security capability matching the size and extent of threats, and the criticality and sensitivity of your information assets.

Policy framework

Maintain an information-security policy framework that guides personnel and third parties.

Information asset identification

Know what information assets you hold, and rank them by how critical and sensitive they are.

Implementation of controls

Put controls in place that protect your information assets from threats and weak points.

Incident management

Find and respond to security incidents in good time.

Testing control effectiveness

Test your controls on a regular plan and act on what the tests find.

Internal audit

Have internal audit review how well your security controls are designed and how well they work.

APRA notification

Tell APRA within 72 hours of a security incident that has, or could have, a material impact.

Sources

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.