APRA CPS 234 · Evidence & Implementation Kit
Meet APRA's information security standard with the evidence a prudential review actually asks for.
Every CPS 234 requirement handed to you as an adopt-ready control, with the APRA-specific nuance, the exact evidence APRA and internal audit examine, and the finding they most often raise.
Review-ready in a weekend, not a quarter.
Here is the honest situation. CPS 234 is mandatory for APRA-regulated banks, insurers and superannuation funds, and it is enforced. It puts ultimate responsibility with the Board, requires controls and testing commensurate with the threats you face, extends to your third parties, and demands notification to APRA within 72 hours of a material incident. The hard part is the evidence: the asset register, the testing program, the incident runbooks and the third-party assurance, all in the form a prudential review expects.
This Kit removes the build. It is every CPS 234 requirement as a control you personalize in a weekend, grounded in the standard and APRA's practice guide.
What you get, the moment you buy
32
Requirements as adopt-ready controls. Every CPS 234 requirement across roles, capability, policy, asset classification, control implementation, incident management, testing, internal audit, APRA notification and third-party management. Personalize and you are done.
32
Evidence-they-examine checklists. For each requirement, exactly what APRA or internal audit examines, plus the finding they most often raise, and the APRA-specific nuance.
1
CPS 234 Control Matrix, pre-built. Every requirement in a working spreadsheet, ready to record your implementation, status and evidence location.
1
Gap & Readiness Assessment. Score each requirement and the workbook tells you your readiness as a single percentage, and exactly what to fix next.
Grounded in CPS 234 and CPG 234, with Board accountability, the 72-hour and 10-business-day notification timeframes, control testing and third-party assurance called out. Editable Word and Excel files.
The Board owns this, and third parties are in scope
CPS 234 places ultimate responsibility with the Board and extends to information assets managed by related parties and third parties. This Kit makes both explicit, so your governance and your vendor assurance are evidenced the way a prudential review expects.
What one control looks like
This is the requirement to notify APRA within 72 hours of a material incident, one of the sharpest obligations. All 32 are built to this depth.
CPS234-27 Notify APRA within 72 hours of a material incident APRA NOTIFICATION
Adopt this requirement
[Regulated entity] notifies APRA as soon as possible and no later than 72 hours after becoming aware of an information security incident that materially affected, or had the potential to materially affect, financially or non-financially, the entity or the interests of depositors, policyholders, beneficiaries or other customers, or that has been notified to other regulators in Australia or other jurisdictions. A defined process assigns responsibility and triggers notification even where information is incomplete.
Evidence APRA or internal audit examines
- The APRA notification procedure with the 72-hour trigger and owner
- Materiality criteria used to decide whether an incident is notifiable
- Records of past notifications with timestamps against awareness
- Evidence the process links to other-regulator notification triggers
Common finding they raise: The entity waits for full incident facts before notifying, breaching the as-soon-as-possible and 72-hour expectation.
Why this is not another template pack
- The evidence is the point. Generic security templates ignore the prudential lens. This tells you exactly what APRA or internal audit examines and the finding they raise, for every requirement. That is what withstands a review.
- Written for the standard. Board accountability, the asset register, control testing, incident notification and third-party assurance are built in, not bolted on.
- Built on a mapped compliance corpus, not one person's opinion, from a graph of thousands of controls across standards.
- It compounds. CPS 234 aligns with ISO 27001 and the other APRA CPS standards, so your security and prudential work share the same evidence base.
Who buys this
APRA-regulated banks, insurers and superannuation funds and their subsidiaries, the security, risk and audit leads who own CPS 234, and consultants preparing entities for a prudential review. Whether it is a first uplift or an assurance review, you save weeks and walk in with the register, testing and runbooks ready.
By the end of the weekend you will have
✓ A control for every CPS 234 requirement
✓ A completed CPS 234 control matrix
✓ The evidence APRA and internal audit examine
✓ Your asset register and testing program anchored
✓ A readiness percentage and a fix list
✓ The common findings closed before a review
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
Does this make me compliant? Compliance is assessed by APRA. The Kit gets you ready: the requirements, the matrix, and the exact evidence they examine.
Does it cover third parties? Yes. Management of related and third parties is covered as its own theme, which is a frequent review focus.
Does it cover the notification timeframes? Yes. The 72-hour material-incident and 10-business-day material-control-weakness notifications are built in.
What if it is not for me? A 30-day money-back guarantee.
Do not meet a prudential review without the evidence in hand.
A consultant is tens of thousands and months. The Kit is instant, and it is guaranteed.
Add it to your cart and be review-ready this weekend.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com
