APRA CPS 234

What is APRA CPS 234?

APRA CPS 234 is the Australian prudential standard on information security. The Australian Prudential Regulation Authority (APRA) publishes it, and it binds APRA-regulated entities: authorised deposit-taking institutions, general insurers, life companies, private health insurers and superannuation trustees. It requires them to stay resilient against information security incidents, including cyber-attacks.

The full title is Prudential Standard CPS 234 Information Security. The current version is dated July 2019 and has been in force since 1 July 2019. APRA's page lists it as in force, and we found no APRA notice of a revision. APRA's own page for the standard is on the APRA website.

The standard asks each entity to keep an information security capability that matches its vulnerabilities and threats. It is written as duties on the entity and its Board, not as a certification scheme.

Why it matters

An Australian bank's supplier review cites CPS 234 in the first paragraph. Your contract renewal is waiting on the answer.

That is how most people meet the standard. It puts information security on the Board's agenda, and it puts incident reporting to APRA on a 72-hour clock.

The reach is the second reason. Where a related party or third party manages an entity's information assets, the standard applies to those assets too. Suppliers feel CPS 234 through contract terms and assurance requests, even though they are not regulated by APRA.

Outsourcing the asset does not outsource the accountability.

Who it applies to

CPS 234 applies to:

• authorised deposit-taking institutions (ADIs);
• general insurers;
• life companies;
• private health insurers;
• RSE licensees (superannuation trustees);
• non-operating holding companies and the heads of groups.

For foreign ADIs, Category C insurers and eligible foreign life insurance companies, the obligations apply only to their Australian branch operations.

The obligation is mandatory. CPS 234 is a prudential standard made under Australian statute, so regulated entities must comply. A firm that is not APRA-regulated has no direct duty, though it may carry one by contract if it manages a regulated entity's information assets.

The nearest framework most UK firms already hold is ISO 27001. APRA's practice guide, CPG 234, is non-enforceable and does not replace or endorse industry standards, so entities choose which standards to adopt in specific control areas. An ISO 27001 management system is one such choice, not a way around CPS 234. Our ISO 27001 guide covers the standard itself.

The UK position

No UK law or regulator names CPS 234, and a UK firm rarely meets it directly. There are two ways it arrives:

• Group structure. A UK-headquartered group with an Australian ADI, insurer or superannuation operation is covered for that entity. A UK bank or general insurer with an Australian branch is covered for the branch only.
• Supply contracts. A UK software vendor or managed services provider to an APRA-regulated entity meets CPS 234 in the contract. The entity must cover third-party controls in its testing and internal audit, so expect questions about your controls. For existing third-party contracts, the standard applied from the earlier of the next renewal or 1 July 2020.

For a UK supplier of 25 to 250 people, the usual first encounter is a customer questionnaire, not a regulator.

Key requirements

The Board of an APRA-regulated entity is ultimately responsible for its information security. Four headline requirements follow from that:

1. Roles and responsibilities. Define who is accountable for information security across the Board, senior management, governing bodies and individuals.
2. Capability. Maintain an information security capability matched to the vulnerabilities and threats the entity faces, including where third parties manage its assets.
3. Controls and testing. Implement controls and test their effectiveness through a systematic testing program.
4. Notification. Tell APRA about material incidents and weaknesses.

The standard is organised into sections: roles and responsibilities, information security capability, policy framework, information asset identification and classification, implementation of controls, incident management, testing control effectiveness, internal audit, and APRA notification.

Notification deadlines

Two clocks run under CPS 234:

• 72 hours after the entity becomes aware of a qualifying information security incident;
• 10 business days after it becomes aware of a material control weakness that it expects it cannot fix in a timely manner.

An incident qualifies if it materially affected, or could have materially affected, the entity or its customers, or if it has been notified to another regulator, in Australia or elsewhere.

What a CPS 234 audit covers

The "audit" in CPS 234 has two parts, and both sit inside the entity.

• Testing. The entity tests its controls through a systematic program. Testing must be done by appropriately skilled and functionally independent specialists, and the program is reviewed at least annually or after a material change.
• Internal audit. Internal audit must check that information security controls are well designed and work in practice, including controls run by related parties and third parties. Where an incident at such a party could materially affect the entity, internal audit must assess that party's assurance before relying on it.

A control nobody tests is a belief, not a control.

Related APRA standards

CPS 234 supports CPS 220 Risk Management, a core standard in APRA's Risk Management Pillar. CPS 230 Operational Risk Management is a separate standard: it covers operational risk, keeping critical operations running through disruption, and managing service providers. The non-enforceable CPG 234 practice guide explains APRA's expectations for CPS 234. The binding text is the standard itself.

Frequently asked questions