APRA CPS 234

No changes recorded yet — we are watching, and nothing has been published.

1. 2020-07-01 Latest date from which CPS 234 applies to information assets managed by third parties (earlier if the contract was renewed before then)
2. 2019-07-01 CPS 234 comes into force
3. 2018-11-07 APRA releases the final CPS 234 and its response to submissions

1. 2018-11-30
   CPS 234 (prudential standard determination No. 1 of 2018) Major versionCurrent

   The original information security standard, determined on 30 November 2018 and in force from 1 July 2019. source

   More

   • For information assets managed by third parties, the requirements apply from the earlier of the next contract renewal or 1 July 2020.

All APRA-regulated entities must maintain an information security capability matched to the threats to their information assets, including assets managed by related and third parties.

Who

ADIs (including foreign ADIs) and authorised banking NOHCs; general insurers, including Category C insurers, authorised insurance NOHCs and Level 2 insurance group parents; life companies, friendly societies, EFLICs and registered life NOHCs; private health insurers; and RSE licensees. source

Foreign branches

For a foreign ADI, a Category C insurer or an EFLIC, the obligations apply only to its Australian branch operations. source

Groups

A Head of a group must also apply the requirements throughout the group, including to entities that are not APRA-regulated. source

Board

The Board of an APRA-regulated entity is ultimately responsible for ensuring that the entity maintains its information security. source

The entity tests its own controls through a systematic testing program, reviews response plans and the testing program at least annually, and internal audit reviews the controls.

Control testing

Test the effectiveness of information security controls through a systematic testing program, and review its sufficiency at least annually or on a material change. source

Response plans

Review and test information security response plans annually. source

Internal audit

Internal audit must review the design and operating effectiveness of information security controls, including those maintained by related parties and third parties. source

Incident notification

Notify APRA as soon as possible and no later than 72 hours after becoming aware of a material information security incident, or of one notified to other regulators. source

Control weaknesses

Notify APRA within 10 business days of becoming aware of a material control weakness the entity does not expect to remediate in a timely manner. source

APRA supervises compliance and can use formal enforcement powers when supervision does not resolve a problem.

Approach

APRA works mostly through supervision but will use formal enforcement powers to prevent and address serious prudential risks and to hold entities and individuals to account. source

Enforceable undertakings

APRA may accept an enforceable undertaking from an institution or individual in connection with a matter within its functions or powers. source

Disqualification

Under the Financial Accountability Regime Act 2023, APRA can disqualify individuals from accountable person roles in APRA-regulated entities. source

1. Law text Prudential Standard CPS 234 Information Security
2. Law text CPS 234 on the Federal Register of Legislation (F2018L01745)
3. Guidance Prudential Practice Guide CPG 234 Information Security

1. APRA CPS 230

   APRA's operational risk standard covering critical operations, business continuity and material service providers, rather than information security controls.

2. DORA

   The EU regulation on ICT risk and resilience for financial entities, with its own incident reporting and third-party oversight regime.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to APRA CPS 234 (RSS)