APRA CPS 234: Information Security Prudential Standard | UpGuard

**Executive summary:** This report outlines APRA's CPS 234 information security standard for regulated Australian financial institutions, summarizing required governance (board and senior management responsibilities), information asset classification, implementation and testing of security controls, incident response and notification requirements (including a 72-hour incident reporting timeframe), and the emphasis on third-party risk, with compliance expected from 1 July 2019 (and third-party arrangements by contract renewal or 1 July 2020).