APRA CPS 234 Information Security Guide (2026): Requirements, Notification and CPS 230

Who it applies to

CPS 234 applies to all APRA-regulated entities (CPS 234):

• ADIs, including foreign ADIs, and authorised banking NOHCs
• general insurers, including Category C insurers, authorised insurance NOHCs and parent entities of Level 2 insurance groups
• life companies, including friendly societies, EFLICs and registered life NOHCs
• private health insurers
• RSE licensees, in respect of their business operations

For foreign ADIs, Category C insurers and EFLICs, the standard applies only to Australian branch operations. A Head of a group must apply the requirements across the group, including to entities that aren't APRA-regulated. Service providers aren't directly regulated. However, an entity's obligations extend to information assets that related parties and third parties manage for it (CPS 234).

Key requirements

The standard's paragraphs set out the following obligations (CPS 234):

• Roles and responsibilities (paras 13–14). The Board is ultimately responsible. You must clearly define information security roles for the Board, senior management, governing bodies and individuals.
• Information security capability (paras 15–17). Your capability must match the size and extent of threats you face. Where a third party manages your assets, assess that party's capability. Keep your capability current as threats change.
• Policy framework (paras 18–19). Keep a policy framework that gives direction to everyone with security obligations, including contractors, third parties and customers.
• Asset classification (para 20). Classify all information assets, including third-party-managed ones, by criticality and sensitivity.
• Controls (paras 21–22). Implement controls in a timely way, in proportion to threats, criticality and sensitivity, the asset's life-cycle stage and the potential consequences. Evaluate the design of controls at third parties.
• Incident management (paras 23–26). Have robust detection and response mechanisms. Keep response plans for plausible incidents that cover every stage up to post-incident review, plus escalation to the Board. Review and test these plans every year.
• Testing control effectiveness (paras 27–31).
• Run a systematic testing programme, with frequency set by the rate of threat change, criticality, consequences, exposure to untrusted environments and how often things change.
• Escalate deficiencies you can't remediate in time to the Board or senior management.
• Use skilled, functionally independent testers.
• Review the testing programme at least once a year.
• Internal audit (paras 32–34). Internal audit must review the design and operating effectiveness of controls, including third-party controls. It must also assess third-party assurance it relies on where the impact could be material.
• APRA notification (paras 35–36).
• No later than 72 hours after becoming aware of an incident that materially affected, or could have materially affected, the entity or its customers, or that has been notified to another regulator.
• No later than 10 business days after becoming aware of a material control weakness that you don't expect to remediate in time.

APRA has also urged regulated entities to strengthen authentication controls, including multi-factor authentication (APRA).

Certification process and timeline

CPS 234 has no certification. Compliance is supervised by APRA, and assurance comes from internal audit and independent testing. Key dates:

• 1 July 2019: CPS 234 commenced. For information assets managed by third parties, the requirements applied from the next contract renewal or 1 July 2020, whichever came first (CPS 234).
• 1 July 2025: CPS 230 Operational Risk Management took effect (APRA).
• 1 July 2026: targeted CPS 230 amendments took effect, introducing limited contractual exemptions for certain service-provider types. APRA declined a suggestion to streamline CPS 230 and CPS 234 overlaps, and said it will monitor how CPS 230 operates (APRA).

APRA's practice guide CPG 234 gives non-binding guidance on implementation (APRA).

Costs

APRA doesn't publish compliance costs for CPS 234, so none are given here.

Penalties

CPS 234 itself doesn't set fines. APRA has "warned of possible enforcement action against entities failing to comply with their CPS 234 obligations" (APRA).

In June 2023, APRA imposed a $250 million increase in Medibank's capital adequacy requirement, effective 1 July 2023. APRA said this reflected weaknesses in Medibank's information security environment. The adjustment remains in place until an agreed remediation programme is complete, and APRA also ordered a targeted technology review (APRA).

Mapping to related frameworks

• ISO 27001: its ISMS, risk assessment, internal audit and incident clauses line up closely with CPS 234.
• NIST CSF: provides a structure for capability and testing.
• Essential Eight: a common technical baseline for authentication and patching in Australia.
• CPS 230: covers business continuity and material service providers (APRA).
• DORA and MAS TRM: comparable financial-sector regimes elsewhere.

Readiness checklist

1. Record the Board's accountability, and define security roles at every level.
2. Classify all information assets by criticality and sensitivity, including those held by third parties.
3. Assess third-party security capability and the design of their controls.
4. Keep a documented control set in proportion to risk.
5. Run a systematic testing programme with independent specialists, and review it every year.
6. Make sure internal audit covers the design and operating effectiveness of controls.
7. Test your incident response plans every year.
8. Set up 72-hour incident and 10-business-day weakness notification procedures.
9. Strengthen MFA and authentication controls.
10. Align your work with CPS 230 for continuity and service providers.

Common pitfalls

• Policy without implementation depth. APRA's Medibank action shows that identified weaknesses carry real consequences.
• Overlooking assets held by related parties or fourth parties.
• Testing that isn't independent, or that doesn't match how quickly threats change.
• Missing the 72-hour trigger when an incident has already been notified to another regulator.
• Treating CPS 234 and CPS 230 as separate programmes.

How AssureCore helps

• The Controls Register and Cross-framework Mapping link CPS 234 to ISO 27001 and the Essential Eight.
• The Risk Register and Evidence Management, with expiry alerts, track testing and audit evidence.
• Policy Management, with gap analysis, supports the policy framework.
• Audit Reports help prepare Board and supervisor packs.

Frequently asked questions

Official references

• APRA – CPS 234 Information Security
• Federal Register of Legislation – Prudential Standard CPS 234 (F2018L01745)
• APRA – Cyber security
• APRA – Operational risk management (CPS 230)
• APRA – Final targeted amendments to CPS 230 (30 April 2026)
• APRA – APRA takes action against Medibank Private (27 June 2023)
• APRA – CPG 234 Information Security practice guide

Related frameworks

• PCI DSS guide
• SOX IT guide
• ICIF guide
• DORA guide