CPS 234 compliance software

Make security assurance easier to review.

Organise CPS 234 controls, assess gaps and connect supporting evidence. Give your APRA information-security programme a shared view of implementation.

Start 14-day trial Book a walkthrough

14-day Professional trial · no credit card required

Inside VenveraProduct preview

Shared control workspace: implementation and assurance records.

Real product screen · example dataExplore the workflow

Control coverage
Gap assessment
Programme oversight

A practical way to move forward

Know the work. See the progress.

One workspace for the requirements, the people doing the work and the records behind your next review.

Control coverage

Give assurance a working structure.

Work through CPS 234 controls and record implementation. Keep the evidence supporting each area accessible for programme reviews.

CPS 234 control library
Implementation and evidence records

Gap assessment

Identify where the programme needs work.

Assess your current position and review the gaps. Bring security, risk and third-party stakeholders into the same discussion.

Structured CPS 234 assessment
Assessment results and coverage

Programme oversight

Keep progress visible to reviewers.

Use the framework dashboard alongside the underlying records. Connect relevant policies, risks and evidence from the wider platform.

Framework dashboard
Connected security and risk records

The detail behind the dashboard

Give every review a better starting point.

Move from a progress summary to the records that support it. Keep the next conversation focused on the work that needs attention.

Screens show example data. Shared platform features and availability depend on your plan.

See it with our team

Shared evidence workspace: organise supporting security material.Open full size

Start with the right scope

For APRA-regulated entities coordinating information-security assurance.

CPS 234 sets information-security requirements for APRA-regulated entities, including controls over assets managed by related and third parties. Your capability, testing and response arrangements must reflect your risks.

APRA: CPS 234 Information Security (opens in a new tab)

Use the work you already have

Find the overlap. Review the gaps.

Explore shared requirements and download a CSV. A mapping identifies related work; it does not certify compliance.

Explore CPS 234 control mappings

You already run

You have been asked to add

7 of the 53 domains in this crosswalk appear in both NIST CSF 2.0 and CPS 234.

Domain	NIST CSF 2.0	CPS 234
Incident Management	RS.MA-01Incident Management Execution RS.AN-03Forensic Analysis	CPS234-23Detection and response mechanisms CPS234-24Information security response plans CPS234-25Response plan content and escalation
Incident Reporting	RS.CO-02Internal Stakeholder Reporting	CPS234-35Notification of material incidents within 72 hours CPS234-36Notification of material control weakness within 10 business days
Post-Incident Review	RS.AN-08Incident magnitude is estimated and validated	CPS234-26Annual review and testing of response plans
Third-Party Risk Management	GV.SC-03Supply chain risk management is integrated into risk management	CPS234-16Assessment of related party and third party capability
Supplier Due Diligence	GV.SC-06Planning and due diligence are performed for supplier relationships	CPS234-22Evaluation of third party control design
Information Security Policy	GV.PO-01Cybersecurity Policy	CPS234-18Information security policy framework CPS234-19Policy direction for all obligated parties
Data Classification	PR.DS-10Data-in-Use Protection	CPS234-20Classification of information assets by criticality and sensitivity

A row means the two requirements cover the same ground, so one implementation and one set of evidence can usually serve both. It does not mean satisfying one certifies the other: each framework keeps its own scope, wording and assessment, and some requirements have no counterpart at all. Treat this as a starting map for planning, then confirm each row against the requirement text.

Go deeper

Your CPS 234 reading list.

How an Annex A control set is organised

The ISO 27001 control set that answers several CPS 234 paragraphs, and where it stops.

How to collect audit evidence

What counts as verifiable evidence, and the collection method behind an internal audit.

Incident reporting deadlines by regulation

The CPS 234 72 hour clock next to the DORA, GDPR, NIS2 and AI Act ones, and which binds first.

Browse all 4 guides

How to perform a third party risk assessment

Before you get started

A few useful answers.

Want to discuss your framework and current process?

Talk it through with us

Does the module notify APRA for us?

No. Your entity remains responsible for determining notification obligations and reporting through the required APRA channels. The module supports controls, gap assessment and programme records.

Can we use records relating to third-party managed assets?

Yes. You can organise the relevant controls and supporting evidence in your programme. Your entity still needs to evaluate the information-security arrangements and assurance appropriate to those assets.

Can we use our existing evidence?

Yes. Bring your policies and supporting evidence into Venvera and link them to the relevant controls. Cross-framework mappings help you identify reusable work; your team still reviews whether the evidence meets each requirement.

What is included in the trial?

The 14-day Professional trial includes up to five frameworks and unlimited users, with no credit card required. You can explore the controls, assess gaps and organise your compliance work. Framework modules are on paid plans; compare plans for feature availability.

CPS 234 by Venvera

Give your next review a clearer starting point.

14-day Professional trial · no credit card required · up to 5 frameworks · unlimited users

Start 14-day trial Explore all frameworks