The information security standard APRA will test.

CPS 234 Information Security is the prudential standard APRA made to ensure an APRA-regulated entity is resilient against information security incidents, including cyber attacks. It applies to authorised deposit-taking institutions including foreign ADIs and authorised banking NOHCs, general insurers including Category C insurers and insurance NOHCs, life companies including friendly societies and EFLICs, private health insurers registered under the PHIPS Act, and RSE licensees in respect of their business operations. It commenced on 1 July 2019, and where your information assets are managed by a third party it applied from the earlier of the next contract renewal or 1 July 2020. Paragraphs 1 to 12 deal with authority, application, interpretation and definitions; paragraphs 13 to 36 are the requirements you actually have to meet.

Twenty-four numbered requirements under nine headings. Roles and responsibilities, starting with the Board, which is ultimately responsible for the information security of the entity. An information security capability sized against the threats to your information assets. A policy framework that gives direction to everyone with an obligation, including contractors, consultants, related parties, third parties and customers. Classification of information assets by criticality and sensitivity. Controls implemented in a timely manner and sized against four named factors. Incident detection, response plans and an annual test of them. A systematic control testing programme, with testing done by people who are functionally independent. Internal audit review of the design and operating effectiveness of controls. And notification to APRA within 72 hours of a material incident, or 10 business days for a material control weakness you cannot remediate in a timely manner.

The word appears repeatedly in the standard and is never defined, which is deliberate: APRA is refusing to set a single bar for a population that runs from a small RSE licensee to a major bank. In practice it moves the burden of proof onto you. It is not enough that your controls are good; you have to be able to show the reasoning by which you decided they were the right size for the threats to your information assets. A reviewer asks for that judgement in writing, with its inputs, such as threat intelligence, peer comparison and incident history. An entity with strong controls and no documented sizing rationale is the one that gets a finding.

Yes, and more widely than most entities scope it. Paragraphs 16, 22, 28 and 34 each carry an explicit footnote stating that they apply to all information assets managed by related parties and third parties, not only those captured under agreements for material outsourced business activities under CPS 231 or SPS 231. That means you assess the information security capability of those parties, evaluate the design of their controls, assess whether the testing you rely on is commensurate with the five factors in paragraph 27, and have internal audit assess assurance you intend to rely on where an incident could materially affect you or your customers. Scoping that work to the material outsourcing register is the single most common gap in the standard.

Paragraph 30 requires testing by specialists who are appropriately skilled and functionally independent. Functional independence is about reporting lines rather than about hiring an external firm, so an internal team can qualify provided it does not own or operate the control it is testing. The common failure is a security team that runs the network controls and also performs the penetration testing against them. Paragraph 27 separately requires the programme to be systematic, with nature and frequency set against five factors, one of which is the risk from environments where you cannot enforce your own policies, which in practice means your cloud and third party estate.

At awareness. Paragraph 35 requires notification as soon as possible and no later than 72 hours after becoming aware of an information security incident that materially affected, or had the potential to materially affect, the entity or the interests of depositors, policyholders, beneficiaries or other customers. There is a second limb that catches entities out: you must also notify APRA of an incident that has been notified to other regulators, in Australia or another jurisdiction, whether or not you assess it as material to yourself. Paragraph 36 is a separate clock, 10 business days, for a material information security control weakness you expect you will not be able to remediate in a timely manner, and it starts when you become aware of the weakness, not when you conclude it cannot be fixed.

APRA has used tripartite reviews, where an independent expert is engaged to test the entity’s own assertions against the standard, alongside its ordinary supervisory activity. That shapes what evidence is worth holding: the reviewer is looking for records that show a duty was discharged, not documents that describe an intention. Board minutes showing challenge rather than receipt, a dated test of the response plan rather than a reviewed plan, the escalation record for a deficiency that could not be remediated in time, and the assessment behind your reliance on a third party’s testing.

It ships the 24 requirements as paragraphs 13 to 36, grouped under the standard’s own nine headings, each with an owner, a status, its own evidence and authored guidance on what a reviewer accepts as proof. A 42 question gap assessment scores the judgement calls the standard leaves open, which is where the word commensurate actually bites. The recurring duties land on a compliance calendar with owners and dates: the annual response plan test, the annual review of the testing programme, the internal audit review, the asset classification refresh and the third party reassessment. A board report summarises the position for the Board that paragraph 13 makes ultimately responsible.

CPS 234 is about information security specifically. CPS 230 Operational Risk Management is the broader operational resilience standard and covers service provider management and business continuity more widely, so the two overlap on third party management without being substitutes. ISO 27001 is a certifiable international standard with its own management system and Annex A control set; holding it is useful evidence for several CPS 234 paragraphs, particularly around policy framework and control implementation, but it is not compliance with CPS 234 and APRA does not treat it as such. The paragraphs that ISO 27001 does not answer on its own are the ones specific to the prudential context: Board accountability under paragraph 13, the customer impact dimension of classification under paragraph 20, and the two notification clocks.