Assess · APRA-regulated
APRA-regulated entities carry two binding obligations: CPS 234 for information security, and CPS 230 for operational risk and resilience, now in force. Your board attests to both. We measure your capability against each, control by control, and hand you the gap register and the assurance your board and APRA expect to see.
Scope agreed in writing before any work. No obligation.
What you are commissioning
This page is backed by two named engagements from the Assess track: information-security readiness against CPS 234, and operational-resilience readiness against CPS 230. Each is scoped on its own, and teams often run them together.
Assess trackTypically 3–4 weeks
Meet the prudential standard your board attests to, with the evidence to prove it.
Best for APRA-regulated entities and the providers who serve them.
Includes
Deliverables
Assess trackTypically 3–5 weeks
Show you can keep critical operations running through disruption, and that your providers can too.
Best for APRA-regulated entities preparing for CPS 230.
Includes
Deliverables
CPS 234 makes your board ultimately responsible for information security, and CPS 230 raises the bar on operational resilience. Directors want evidence behind the attestation, not assurances. We give them a defensible read.
The operational-risk standard commenced on 1 July 2025, with extended timing for some service-provider requirements. Teams that built for CPS 234 alone need to close the resilience and service-provider gaps the new standard introduces.
You are a material service provider to a bank, insurer, or superannuation fund, and their CPS 234 and CPS 230 obligations now reach into your controls. A readiness read lets you answer their assurance requests with evidence.
The method
CPS 234 capability is assessed against each requirement: information-security roles and board accountability, the classification of information assets, control implementation and testing, and incident response. No paraphrase, the standard as written.
CPS 230 turns on knowing your critical operations and the tolerance levels for disruption you can sustain. We identify them, test them against severe-but-plausible scenarios, and surface where continuity and recovery fall short of the tolerances you have set.
Both standards extend to the providers you depend on. We map material service-provider arrangements, surface concentration and exit risk under CPS 230, and test the third-party assurance CPS 234 requires, so the obligations you have passed down are actually being met.
Findings are cross-mapped to ISO 27001 and SOC 2, so the work you do for APRA also serves the certifications your customers ask for. One control set, evidenced once, rather than a separate project per regulator.
The path
Readiness is the first move, and every step after it is a separate decision that stays yours.
Readiness: the gap register against CPS 234 and CPS 230, with a board-ready assurance summary
Remediation: gaps closed under Build, by us, your team, or a partner under our oversight
Assurance: control testing and evidence kept current, continuously, under Operate
Questions
Yes. CPS 230 commenced on 1 July 2025, replacing the earlier business-continuity and outsourcing standards, with some service-provider requirements phased on a longer timeline. We assess against the standard as it now binds you and flag where transitional timing still applies.
Usually yes, and it is the efficient path. The two overlap on governance, third-party risk, and incident management, so a combined engagement avoids assessing the same ground twice. Each still resolves to its own readiness report, so the board sees each obligation clearly.
It can reach you. Both standards make APRA-regulated entities responsible for the risks their material service providers carry, so those entities increasingly require evidence from you. A readiness read lets you meet those requests with a defensible position rather than a questionnaire scramble.
No, and that is deliberate. Compliance with a prudential standard is a matter between the entity, its board, and APRA, and independent assurance is exactly what the standards contemplate. We prepare you, evidence the gaps, and stand beside you, but we never mark our own work.
They reinforce each other. Most of what CPS 234 expects maps to ISO 27001 Annex A and the SOC 2 criteria, so we measure once and map across, and you avoid running an APRA project and a certification project in parallel.
One conversation, then the scope and the price in writing. Your enquiry arrives already marked for apra cps 234 & 230.