APRA's Prudential Standard CPS 234 Information Security applies to banks, insurers and superannuation trustees, and it explicitly reaches information assets managed by related parties and third parties. For a fintech, SaaS vendor, software house or managed service provider that serves a regulated entity, that means your customer will assess your security capability, ask for evidence, and write requirements into your contract. This guide explains what CPS 234 requires, what customers typically ask suppliers for, and how a smaller supplier can prepare. It is general guidance, not legal advice. EITSAA does not hold any certification and does not assess compliance. We help you design and evidence the technical controls.
What CPS 234 requires, in plain terms
CPS 234 is principles-based. The regulated entity must:
- Clearly define information security roles and responsibilities for the board, senior management and individuals, with the board ultimately responsible.
- Maintain an information security capability commensurate with the size and extent of threats to its information assets.
- Implement controls to protect its information assets, commensurate with their criticality and sensitivity, and test the effectiveness of those controls systematically.
- Maintain an incident response plan and test it at least annually.
- Notify APRA of material incidents and material control weaknesses.
The standard applies to information assets managed by third parties. Where a third party manages the assets, the entity must assess the information security capability of that party, in proportion to the potential consequences of an incident affecting those assets. APRA's guidance makes clear that a third party's own certification or regulatory status is a useful input but not a substitute for the entity's own assessment.
Notification obligations that reach suppliers
The entity must notify APRA as soon as possible and no later than 72 hours after becoming aware of an information security incident that materially affected, or had the potential to materially affect, the entity or its customers, or that has been notified to other regulators. It must notify within 10 business days of becoming aware of a material information security control weakness that it does not expect to remediate in a timely manner. Because the entity needs your facts to meet those clocks, your contract should require you to tell them quickly, usually within hours rather than days. Build your own incident process so that you can give a clear first notice and updates. The incident notification reference architecture shows one way to do this. Where personal information is involved, also plan for the Privacy Act Notifiable Data Breaches scheme.
How CPS 234 and CPS 230 fit together
CPS 234 is about protecting information assets. CPS 230 is about operational risk, critical operations and service provider management more broadly. A cloud or SaaS supplier that supports a critical operation will usually face both: security questions under CPS 234, and requirements under CPS 230 for audit access, sub-contractor notification, exit support, service levels and tested continuity. APRA has said that where an incident is notifiable under both, a single notification is sufficient and the earliest timeframe applies. See CPS 230 explained for ICT leaders.
What regulated customers usually ask suppliers for
| Area | Typical evidence request |
|---|---|
| Governance | Security policy, roles, risk register, a named security owner |
| Independent assurance | ISO/IEC 27001 certificate, SOC 2 report, penetration test summaries, PCI DSS attestation where card data is involved |
| Access control | MFA, least privilege, joiner-mover-leaver process, privileged access management, access reviews |
| Data protection | Encryption at rest and in transit, key management, data location, segregation of customer data, retention and deletion |
| Secure development | Code review, dependency and vulnerability scanning, change control, separation of environments |
| Vulnerability and patching | Patch timeframes, scan results, Essential Eight maturity |
| Logging and detection | Audit logs, monitoring, alerting, log retention |
| Incident response | Plan, roles, test results, customer notification commitment |
| Resilience | Backup, recovery objectives, test evidence, concentration on a single cloud region |
| Subcontractors | List of fourth parties and how they are assessed |
Independent attestations matter because they reduce your customer's workload, but they are issued only by accredited certification bodies and qualified assessors. A small supplier without them can still compete by providing clear, current, first-party evidence and being open about gaps with a dated remediation plan.
A practical readiness plan for a smaller supplier
- Know what you hold. Inventory the customer data you store or process, where it lives, who can access it and which sub-processors touch it.
- Close the basics. MFA everywhere, least privilege, patching, tested backups, logging, endpoint protection and secure configuration. The ACSC Essential Eight is a sound baseline. See Essential Eight for SA SMEs.
- Reduce what partners and staff can see. Segregate customer data, minimise fields and tokenise where possible. Our integration boundary architecture shows how.
- Write down and test incident response. Include customer notification contacts and timeframes, and run a tabletop at least annually.
- Automate evidence. Collect configuration and control evidence continuously so questionnaires take hours and not weeks. See the evidence automation architecture.
- Choose assurance deliberately. Decide with your customers whether ISO/IEC 27001, SOC 2 or a targeted independent assessment gives the best return, and plan the timing. Work with an accredited body.
- Prepare for audit. Be ready to give audit access that meets your customer's reasonable needs, within an agreed scope and with confidentiality terms.
Contract points to expect
- Time-bound notification of incidents and control weaknesses affecting customer data.
- Right to audit or to receive independent assurance reports.
- Data location, return and deletion at exit.
- Sub-contractor notification and flow-down of security terms.
- Service levels, recovery objectives and testing.
- Liability and insurance provisions that your lawyers should review.
This article reflects the published standards as at October 2026. Take legal advice on contract terms and confirm requirements with your customer.
Talk to an Adelaide team
If you supply an APRA-regulated entity and need to close security gaps or answer due diligence faster, talk to us about a supplier security readiness review or call 0402 401 584. We can map your controls to common customer questions and give you a prioritised plan. See our managed IT and cyber security service.