APRA CPS 234: Australian Information Security Standard

APRA Prudential Standard CPS 234 is Australia's mandatory information security standard for APRA-regulated financial entities. Effective since July 2019, it requires entities to maintain information security capability commensurate with the size and extent of threats to their information assets, and to promptly notify APRA of material security incidents or control weaknesses.

What CPS 234 Covers

CPS 234 takes a principles-based approach organized around key obligations. Boards must ensure that the entity maintains information security commensurate with its threat landscape. Entities must clearly define information security roles and responsibilities, maintain adequate capability (including through third parties), implement controls to protect information assets proportionate to their criticality, and detect and respond to incidents in a timely manner.

Critically, CPS 234 requires APRA notification within 72 hours of becoming aware of a material information security incident and within 10 business days of identifying a material control weakness. The standard also imposes requirements on information security testing, including annual reviews by internal audit.

Who Needs CPS 234 Compliance

CPS 234 applies to all APRA-regulated entities including authorized deposit-taking institutions (banks, building societies, credit unions), general insurers, life insurance companies, private health insurers, and registrable superannuation entity licensees. Third-party service providers are indirectly required to meet CPS 234 expectations through the entity's third-party risk management obligations.

Implementation Approach

Start with a comprehensive information asset inventory and classification exercise. Assess your current security capability against the threat landscape for your entity type. Establish board-level governance with clear accountability for information security. Implement controls proportionate to asset criticality and test them regularly. Develop incident management processes with APRA notification workflows.

Cost Considerations

Implementation costs typically range from $50,000 for smaller entities with mature security programs to $500,000 for larger entities requiring significant uplift. APRA has been actively supervising compliance, issuing findings through supervisory letters and conducting targeted reviews of CPS 234 implementation across the industry.