APRA CPS 234 is an Australian prudential standard that requires regulated entities to maintain information security commensurate with their risks. It sets governance, control, testing, and incident notification expectations for protecting data and systems, including third-party dependencies, so security resilience is managed as an ongoing board and operational responsibility.
What APRA CPS 234 means in practice
APRA CPS 234 is not just a compliance label, it is a prudential expectation that information security must be sized to the entity’s actual risk profile. For regulated organisations, that means security is treated as a standing control environment, not a one-off audit exercise.
The standard matters because it links governance to operational reality. Boards and accountable executives need to be able to show that security risk is understood, owned, and translated into concrete controls for systems, data, and business services.
Governance, control design, and accountability
CPS 234 places clear weight on accountability. A regulated entity needs defined ownership for information security, with governance that can direct priorities, approve risk decisions, and keep pace with business change, outsourcing, and technology dependencies.
That governance layer is important because the standard expects more than policy statements. It is concerned with whether security controls are actually designed, maintained, and supported by management reporting that can surface gaps before they become incidents.
Testing, assurance, and third-party dependence
The standard is also about proving control effectiveness. Security controls need to be tested and reviewed so the organisation can confirm they still work against current threats, not only that they exist on paper.
Third-party and outsourced dependencies are a key part of that assurance model. Where service providers support critical functions or hold sensitive information, the regulated entity still needs visibility into risk, control performance, and the arrangements used to manage that dependence. For a deeper treatment of those obligations, see the APRA CPS 234 Guide.
Incident response and security resilience
CPS 234 treats incident handling as part of resilience, not as an isolated response activity. Organisations are expected to detect, assess, escalate, and notify in a way that reflects the materiality of the incident and the sensitivity of the impacted systems or information.
That makes resilience a continuous discipline. If a control fails, the organisation should already understand how it will contain impact, restore confidence in affected systems, and evidence that the issue has been properly managed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.1 — Policies for information security | CPS 234 requires an organised security governance approach. |
| A.5.19 — Information security in supplier relationships | CPS 234 directly addresses third-party dependencies and oversight. | |
| Recommendation — Establish information security policies that define ownership, direction and risk-based control expectations. Assess supplier security obligations and monitor third-party control performance throughout the relationship. | ||
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | CPS 234 is fundamentally risk-based and board-governed. |
| GV.OV-01 — Oversight of Cybersecurity Risk Management | CPS 234 requires governance oversight of information security outcomes. | |
| DE.CM-01 — Continuous Monitoring of Assets | CPS 234 depends on ongoing testing and assurance over controls and systems. | |
| Recommendation — Set a risk-based security strategy that aligns protections to the entity’s material exposures. Maintain executive and board oversight of security risk, control performance and remediation status. Continuously monitor security controls and system conditions so weaknesses are detected early. | ||
Related resources from NHI Mgmt Group
- What breaks in APRA CPS 234 when API visibility is incomplete?
- How should APRA-regulated organisations build CPS 230 compliance so operational risk, business continuity, and third-party risk do not stay in separate silos?
- How should organisations implement CPS 234 in API-heavy environments?
- Why do third-party integrations create CPS 234 compliance risk?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org