APRA CPS 234 for Suppliers: What Banks Will Ask
CPS 234 does not apply to you directly unless you are an APRA-regulated entity, but it reaches you through your contract if you hold or manage information assets for a bank, insurer or superannuation fund. The standard requires those entities to evaluate your security controls, assess whether your testing is good enough to rely on, and in some cases have their internal audit function review the assurance you provide. That is why the security questions suddenly got harder.
Most Australian suppliers meet CPS 234 as a sixty page questionnaire with no explanation attached. Understanding which paragraph of the standard is driving each question makes the whole exercise shorter, because you can answer the actual obligation instead of guessing. This guide maps the questions back to the standard, from a supplier’s point of view rather than the bank’s.
Who does CPS 234 apply to?
CPS 234 Information Security applies to APRA-regulated entities: authorised deposit-taking institutions, general insurers, life insurers, private health insurers, registered superannuation entity licensees and the non-operating holding companies above them. Suppliers are not regulated by APRA and cannot be fined by APRA. The obligation sits with the regulated entity, which cannot discharge it without your cooperation, so it flows to you through contractual terms and assurance requests.
The reach into suppliers is explicit in the standard. Prudential Standard CPS 234 commenced on 1 July 2019, and for information assets managed by a third party it applied from the earlier of the next contract renewal date or 1 July 2020. In other words, APRA deliberately timed the supplier obligations to land at contract renewal, which is exactly when most Australian suppliers first noticed them.
What does CPS 234 say about third parties?
CPS 234 treats information assets managed by a third party as the regulated entity’s responsibility, and sets specific obligations about them. The entity must classify those assets by criticality and sensitivity. Where a third party manages its information assets, the entity must evaluate the design of that third party’s information security controls. Where the entity relies on the third party’s own control testing, it must assess whether the nature and frequency of that testing is adequate for the risk.
Importantly, these obligations are not limited to formal outsourcing arrangements. The standard states that they apply to all information assets managed by related parties and third parties, not only those captured under outsourcing agreements for material business activities. A small SaaS vendor processing claims data is caught by the same wording as a major managed services provider.
What will an APRA-regulated customer ask a supplier for?
An APRA-regulated customer asks a supplier for four things: a description of the controls protecting its data, evidence that those controls were independently tested, incident notification commitments, and the right to review or audit. Each maps to a specific obligation in CPS 234, and recognising which one is behind a question tells you what evidence will actually satisfy it.
| What you get asked | The obligation behind it | What satisfies it |
|---|---|---|
| A detailed control questionnaire | Evaluating the design of your information security controls | A current ISO 27001 Statement of Applicability or SOC 2 report, mapped to their questions |
| Your penetration test results or testing schedule | Assessing whether your control testing is adequate for the risk | Independent testing on a defined schedule, with evidence of remediation |
| Who tested it, and are they independent | Testing must be done by skilled and functionally independent specialists | An external provider, or an internal team demonstrably independent of the one that built the system |
| Incident notification clauses with tight timeframes | The entity must notify APRA within 72 hours of a material incident | A contractual commitment you can actually meet, backed by a tested response plan |
| Audit or review rights, sometimes with their internal auditors | Internal audit must assess assurance it intends to rely on | Agreed review scope and a report your customer’s internal audit can use |
| A list of your own subcontractors | Sub-contracting introduces further risk the entity must consider | A current supplier register with what each one can access |
If these questionnaires are arriving regularly, build the answers once rather than each time. Our guide on how to answer vendor security questionnaires covers assembling a reusable evidence pack.
Can an APRA-regulated customer rely on your own security testing?
An APRA-regulated customer can rely on a supplier’s security testing, but only after assessing whether the nature and frequency of that testing matches the risk. CPS 234 lists what that assessment considers: how fast the relevant threats and vulnerabilities change, how critical and sensitive the information asset is, the consequences of an incident, exposure to environments where the entity cannot enforce its own policies, and how often the asset changes.
Two consequences follow for suppliers. First, an annual test may be judged insufficient for a system that changes weekly, so be ready to explain your testing schedule in terms of change rate rather than calendar habit. Second, the standard requires testing by appropriately skilled and functionally independent specialists, which is why a scan run by the development team that built the system rarely survives scrutiny. An independent penetration test is the usual evidence, and how often you should test explains how to set a defensible frequency.
What are the CPS 234 notification requirements?
CPS 234 sets two notification clocks for APRA-regulated entities. An entity must notify APRA as soon as possible and no later than 72 hours after becoming aware of an information security incident that materially affected, or had the potential to materially affect, the entity or its customers, or that has been notified to another regulator. Separately, it must notify APRA no later than 10 business days after becoming aware of a material information security control weakness that it does not expect to remediate in a timely manner.
Neither clock is yours, and both become yours by contract. If your customer has 72 hours from becoming aware, the contract will give you a far shorter window to tell them, often 24 hours or less. Before you sign that clause, check that you can actually detect and escalate quickly enough to meet it, because the obligation is operational rather than legal. These timeframes sit alongside, not instead of, your own obligations under the Notifiable Data Breach scheme.
How does CPS 234 relate to CPS 230?
CPS 234 covers information security, and CPS 230 Operational Risk Management covers the wider ability to keep critical operations running and to manage the risks arising from service providers. They are separate standards that operate together: CPS 234 asks whether your controls protect the data, and CPS 230 asks whether the regulated entity could keep operating if you failed. CPS 230 commenced on 1 July 2026.
For suppliers the practical effect is a second set of questions arriving alongside the security ones: service continuity, tolerance levels for disruption, exit arrangements and what happens if the regulated entity needs to leave you. If your customer has started asking about recovery times and exit plans as well as encryption, that is CPS 230 showing up, and the answers belong in a business continuity plan rather than a security questionnaire.
Does ISO 27001 or SOC 2 satisfy CPS 234?
Neither ISO 27001 certification nor a SOC 2 report makes a supplier CPS 234 compliant, because CPS 234 compliance is something only an APRA-regulated entity can have. What a certification or report does is let the regulated entity discharge its obligation to evaluate your controls far more efficiently. The guidance APRA publishes alongside the standard lists certifications, attestations and independent assurance assessments among the ways an entity can form a view of a third party’s capability.
Practically, ISO 27001 tends to travel better with Australian financial services buyers because it certifies a management system and names a scope, while SOC 2 gives more detail about how specific controls operated over a period. Suppliers selling to both banks and international SaaS buyers often end up with both. Our side by side on SOC 2 versus ISO 27001 in Australia covers how to choose, and our comparison of CPS 234 and the ASD Essential Eight covers how the prudential standard lines up against the control baseline many Australian suppliers already follow. Expect the bank to read whichever you provide rather than filing it.
Common questions
What is CPS 234 in simple terms?
CPS 234 is the APRA prudential standard that requires banks, insurers and superannuation funds to maintain information security capability matched to the threats they face, to classify their information assets, to test their controls, and to notify APRA quickly when something material goes wrong. It is a prudential standard rather than legislation aimed at the public, and it is enforced through APRA’s supervision of the entities it regulates.
Is CPS 234 still valid?
Yes. CPS 234 remains in force and has not been replaced. The arrival of CPS 230 Operational Risk Management on 1 July 2026 led some suppliers to assume CPS 234 had been absorbed into it, but the two standards address different things and both apply. Information security obligations continue to come from CPS 234, and operational resilience and service provider management obligations come from CPS 230.
What is a material control weakness under CPS 234?
A material information security control weakness is a gap significant enough that the regulated entity expects it will not be remediated in a timely manner, which triggers notification to APRA within 10 business days. The standard does not define materiality numerically, so entities apply their own thresholds. For suppliers this matters because a weakness in your environment can become a notifiable weakness for your customer, which is why contracts increasingly require you to disclose unremediated findings.
What is a CPS 234 tripartite review?
A tripartite review is an arrangement in which APRA, the regulated entity and an independent third party, usually an external firm, agree the scope of a review of the entity’s information security controls, with the report going to all three. It is a supervisory tool APRA uses with regulated entities, not something imposed on suppliers. Suppliers can be drawn in when the review covers services they provide, so review rights in your contract may be exercised as part of one.
Selling into regulated financial services
Suppliers that handle CPS 234 well treat it as a sales asset rather than a tax. A clear control description, independent testing on a defensible schedule, a supplier register and an incident commitment you can actually meet will get you through assurance faster than competitors who answer each questionnaire from scratch. The same evidence pack works for the next bank, and the one after that.
Siege Cyber helps Australian suppliers prepare for financial services assurance without building an enterprise compliance function. Our cyber security advisory services cover control uplift, assurance evidence and the testing programme behind it, and a virtual CISO can carry the conversation with your customer’s risk team. Get in touch with the questionnaire you are stuck on and we will tell you what evidence closes it.