Shield
Start free trialFree trial
Menu
For your teamFrameworksHow it worksPricingSecurityQuestionsCompareSign in

Frameworks · CPS 234

CPS 234 Information Security, with the evidence behind each paragraph.

For APRA-regulated entities: roles, information security capability, policy, asset classification, controls, incident management, testing, internal audit and APRA notification.

Start a 14-day free trialHow a programme works

The framework

NameAPRA CPS 234 Information Security
Who it applies toAPRA-regulated entities: authorised deposit-taking institutions (including foreign ADIs) and authorised banking non-operating holding companies; general insurers (including Category C insurers), authorised insurance non-operating holding companies and parent entities of Level 2 insurance groups; life companies (including friendly societies and eligible foreign life insurance companies) and registered life non-operating holding companies; private health insurers; and RSE licensees in respect of their business operations. For a foreign ADI, Category C insurer or eligible foreign life insurance company, only the Australian branch operations are covered. A Head of a group must also apply the standard throughout the group.
Schedule, paras 2–4, Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2018 (F2018L01745), as made; registered 12 December 2018; in force from 1 July 2019 with no compilation on the Register, read 10 November 2026
RegulatorAustralian Prudential Regulation Authority
In force on 11 November 2026CPS 234 Information Security, in force from 1 July 2019
Schedule (Prudential Standard CPS 234), paras 1–36, Banking, Insurance, Life Insurance, Health Insurance and Superannuation (prudential standard) determination No. 1 of 2018 (F2018L01745), as made; registered 12 December 2018; in force from 1 July 2019 with no compilation on the Register, read 10 November 2026

What a CPS 234 programme does

Paragraphs as controls

Each requirement is a control citing its paragraph in the standard.

Testing and audit evidence

Link control testing, internal audit and incident records to the paragraphs they evidence, with scheduled re-checks.

Notification records

Keep the record of each information security incident assessment; your organisation decides what to notify and lodges it.

Versions

VersionFromUntilSource
CPS 234 Information Security, in force from 1 July 20191 July 2019CurrentSchedule (Prudential Standard CPS 234), paras 1–36

Controls (23)

CPS 234 Information Security, in force from 1 July 2019. Each control cites its source; your programme holds made.'s plain-English summary of each obligation beside it.

Application

RefControlCitation
Para 4Apply the standard throughout the groupPrudential Standard CPS 234 para 4

Roles and responsibilities

RefControlCitation
Para 13Board responsibility for information securityPrudential Standard CPS 234 para 13
Para 14Define information security roles and responsibilitiesPrudential Standard CPS 234 para 14

Information security capability

RefControlCitation
Para 15Maintain an information security capabilityPrudential Standard CPS 234 para 15
Para 16Assess the capability of related parties and third partiesPrudential Standard CPS 234 para 16
Para 17Keep the capability current with changing threatsPrudential Standard CPS 234 para 17

Policy framework

RefControlCitation
Para 18Maintain an information security policy frameworkPrudential Standard CPS 234 para 18
Para 19Direct everyone with information security obligationsPrudential Standard CPS 234 para 19

Information asset identification and classification

RefControlCitation
Para 20Classify information assets by criticality and sensitivityPrudential Standard CPS 234 para 20

Implementation of controls

RefControlCitation
Para 21Implement information security controlsPrudential Standard CPS 234 para 21
Para 22Evaluate third parties' control designPrudential Standard CPS 234 para 22

Incident management

RefControlCitation
Para 23Detect and respond to incidents in a timely mannerPrudential Standard CPS 234 para 23
Paras 24, 25Maintain information security response plansPrudential Standard CPS 234 paras 24, 25
Para 26Review and test response plans every yearPrudential Standard CPS 234 para 26

Testing control effectiveness

RefControlCitation
Para 27Run a systematic control testing programPrudential Standard CPS 234 para 27
Para 28Check third parties' testing where relied onPrudential Standard CPS 234 para 28
Para 29Escalate deficiencies that can't be fixed in timePrudential Standard CPS 234 para 29
Para 30Use skilled, functionally independent testersPrudential Standard CPS 234 para 30
Para 31Review the testing program's sufficiencyPrudential Standard CPS 234 para 31

Internal audit

RefControlCitation
Paras 32, 33Internal audit of information security controlsPrudential Standard CPS 234 paras 32, 33
Para 34Assess third-party assurance internal audit relies onPrudential Standard CPS 234 para 34

APRA notification

RefControlCitation
Para 35Notify APRA of material incidents within 72 hoursPrudential Standard CPS 234 para 35
Para 36Notify APRA of unremediated material control weaknesses within 10 business daysPrudential Standard CPS 234 para 36

Other frameworks

Facts are as shipped in made. Shield, read from each primary source on the date shown. They describe the law; they aren't legal advice, and your organisation decides how they apply to it.