South Australian small and medium businesses that supply banks, insurers, super funds, utilities, health providers or government quickly meet an alphabet of standards: CPS 230, CPS 234, SOCI, ISO 27001, the Essential Eight, the Privacy Act, PCI DSS and SOC 2. They are different things. Some are laws, some are regulator standards that bind the customer and reach you through contracts, and some are voluntary frameworks used for assurance. This guide maps them in plain language, shows where they overlap, and suggests how to build one control set that serves several of them. It is general guidance, not legal advice, and EITSAA does not hold, or claim, any of these certifications. We help you design and evidence controls, and assurance comes from accredited bodies and qualified assessors.
First, who is actually bound
The most useful question is whether the standard binds you directly, or binds your customer and reaches you by contract.
| Standard | What it is | Who is bound | How it reaches a supplier |
|---|---|---|---|
| APRA CPS 230 Operational Risk Management | Prudential standard on operational risk, critical operations and service providers, in force since 1 July 2025 | APRA-regulated entities | Contract terms, audit access, sub-contractor notification, exit and continuity expectations |
| APRA CPS 234 Information Security | Prudential standard on information security including third-party assets | APRA-regulated entities | Security assessments, incident notification, evidence requests |
| Security of Critical Infrastructure Act 2018 (SOCI) | Law for critical infrastructure assets, with a risk management program, cyber incident reporting and other duties | Responsible entities for covered assets | Supply chain and personnel risk requirements, incident notification support |
| Privacy Act 1988 and the Australian Privacy Principles | Law on personal information, including the Notifiable Data Breaches scheme | Most organisations above the small business turnover threshold, and some regardless of size, such as health service providers | Direct for you if covered, plus contract terms as a processor |
| Cyber Security Act 2024, ransomware payment reporting | Law requiring a report within 72 hours of a ransomware or extortion payment | Businesses with annual turnover above $3 million, and responsible entities for critical infrastructure assets | Direct if in scope |
| ACSC Essential Eight | Eight baseline mitigation strategies with maturity levels | Mandated for some government bodies, otherwise a recommended baseline | Frequently required by contract or tender |
| ISO/IEC 27001:2022 | International standard for an information security management system, certifiable by accredited bodies | Voluntary | Customers ask for a certificate, or accept equivalent evidence |
| PCI DSS v4.0.1 | Payment card industry data security standard | Contractual, through card brands and acquirers | Applies where you store, process or transmit card data, or can affect its security |
| SOC 2 | Attestation report against trust services criteria by an independent auditor | Voluntary | Customers request a Type I or Type II report |
| SA Information Security Management Framework (ISMF) | SA Government framework for information security | SA Government agencies | Contract requirements for suppliers handling government information |
The Australian Government's Protective Security Policy Framework and the IRAP assessment program apply to Australian Government work and cloud services provided to it. They are separate to the list above, and IRAP assessments are carried out by registered assessors. If you pursue federal work, ask your customer which of these apply.
Where they overlap
The standards ask for similar things in different words. A single well-run control can serve several of them:
- Access control and MFA. Essential Eight, ISO 27001, SOC 2, PCI DSS and CPS 234 all want strong authentication and least privilege.
- Patching and vulnerability management. Essential Eight, ISO 27001, SOC 2, PCI DSS and SOCI risk management.
- Logging and monitoring. All of them, with PCI DSS and CPS 234 asking for particular detail and retention.
- Backup and recovery. Essential Eight, CPS 230, ISO 27001 and SOC 2 availability criteria.
- Incident response and notification. CPS 230, CPS 234, SOCI, Privacy Act NDB, ransomware reporting and contractual notice. The clocks differ.
- Supplier management. CPS 230, CPS 234, ISO 27001, SOCI supply chain and SOC 2.
- Data protection. Privacy Act APP 11, PCI DSS, CPS 234 and ISO 27001.
The clocks differ, so know them
| Obligation | Timeframe |
|---|---|
| CPS 230 operational risk incident with material impact | Notify APRA within 72 hours of becoming aware |
| CPS 230 disruption to a critical operation beyond tolerance | Notify APRA within 24 hours |
| CPS 234 material information security incident | Notify APRA within 72 hours of becoming aware |
| CPS 234 material control weakness not expected to be fixed in time | Notify APRA within 10 business days |
| SOCI critical cyber security incident | Report to ASD's ACSC within 12 hours, with written follow-up within 84 hours if the first report was oral |
| SOCI other cyber security incident with relevant impact | Report within 72 hours, with written follow-up within 48 hours of an oral report |
| Ransomware or extortion payment (in scope entities) | Report within 72 hours |
| Notifiable Data Breaches | Assess a suspected breach promptly and within 30 days, and notify the OAIC and individuals as soon as practicable once an eligible breach is confirmed |
As a supplier you are rarely the party that notifies a regulator, but you are often the party that holds the facts. Your contract will set how quickly you tell the customer, commonly within hours. See the incident notification architecture. For a deeper Privacy Act and NDB walkthrough for SA ICT leaders, read Privacy Act and Notifiable Data Breaches for SA organisations.
Which to do first
- Ask what you are bound by, and what your customers will require. A short list from your contracts and tender documents beats guesswork.
- Get the baseline right. Essential Eight maturity level one, then two where customers require it. See our Essential Eight guide.
- Write the control library once. Name each control, its owner and its evidence, and map it to every standard in scope.
- Automate the evidence. The evidence automation architecture shows how.
- Pick assurance where customers need it. ISO/IEC 27001:2022 is a sound general-purpose choice. SOC 2 is frequently asked for by software and cloud customers. PCI DSS applies only if card data is in scope, and good scope reduction through tokenisation can shrink it a lot. Version 4.0.1 is current, and its future-dated requirements became mandatory on 31 March 2025.
- Prepare for CPS 230 and CPS 234 questions. Provide resilience evidence, sub-contractor lists, audit access terms and an exit story. Our guides to CPS 230 and CPS 234 for suppliers explain what customers ask for.
ISO 27001 transition note
Certification bodies have ended the transition from the 2013 edition of ISO/IEC 27001, which closed on 31 October 2025, so new and current certificates now reference the 2022 edition, with its reorganised Annex A controls. If a customer asks for a certificate, confirm that it is to the 2022 edition.
What not to do
- Do not claim a certification, attestation or registration you do not hold, or that your cloud provider holds on its own infrastructure.
- Do not run a separate program for every standard.
- Do not treat a customer's questionnaire as an audit, or an audit as continuous assurance.
- Do not assume that a cloud provider's compliance reports cover your configuration. Under the shared responsibility model, your settings are yours.
This article is a general summary as at October 2026. Requirements, thresholds and dates change and depend on your circumstances. Take legal and assurance advice and confirm with your customers.
Talk to an Adelaide team
If you supply regulated customers and want one control set that answers several of them, talk to us about a standards mapping workshop or call 0402 401 584. We can deliver a scoped control library with evidence sources and a prioritised plan. See also our government and tenders page and managed IT and cyber security.