Frameworks
APRA CPS 234 — Information Security (Australia)
The Australian financial regulator's security standard — reaching every vendor that touches regulated data.
Book a demoAPRA's CPS 234 binds Australian banks, insurers, and superannuation funds to clear information-security obligations: defined roles, capability matched to threats, control testing, and rapid incident notification — and it explicitly extends to information assets managed by third parties, which pulls vendors into scope.
What the regulator expects
Board-owned accountability, an information security capability commensurate with the threat, controls tested systematically, incidents notified to APRA within 72 hours (and material control weaknesses within 10 business days). For vendors to regulated entities, the practical impact is contractual: security obligations, assessment rights, and notification duties flow down.
How Compriska helps
Compriska evidences the control environment CPS 234 assessments probe, runs incident workflows against APRA's notification clocks, and manages the third-party obligations regulated customers push into your contracts.
Frequently asked questions
We're a SaaS vendor to an Australian bank — are we in scope?
Effectively yes: CPS 234 makes the regulated entity accountable for information assets you manage, so their obligations arrive in your contract and their vendor assessments.
Other frameworks
Automate CPS 234 with Compriska
See how cross-mapped controls, continuous evidence, and AI workflows change the cost of compliance.
Book a demo