How to Comply With CPS 234 (Updated for 2023) | UpGuard

This report explains APRA’s CPS 234 prudential standard for information security, detailing who must comply (banks, insurers, superannuation funds, and related third parties), governance responsibilities, and key requirements including capability building, policy frameworks, asset classification, implementation of controls, incident management, control testing, internal audit, and timely notification to APRA (e.g., within 72 hours for material incidents). It outlines practical control areas (vulnerability/threat management, lifecycle, physical, change, software, data leakage, cryptographic, technology, and third‑party controls) and emphasizes continuous monitoring, assurance, and coordination with vendors. The document also highlights how UpGuard’s tools can support compliance, third‑party risk management, continuous monitoring, and reporting.