Description

A focused course, tailored for you

The APRA CPS 234 Security Architecture Playbook

Build the information security architecture that satisfies APRA's CPS 234 standard, from asset register to board reporting.

Security architects at APRA-regulated institutions build controls that work technically. CPS 234 requires those controls to exist as a documented architecture an APRA examiner can follow. The gap between those two things sits in the information asset register, the third-party assessment framework, and the board reporting format, not in the controls themselves.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

CPS 234 architecture compliance fails at the documentation layer, not the control layer. The controls exist. The cloud security architecture is sound. But the information asset register does not trace each asset to the control that protects it. The third-party providers have security arrangements in place, but not in a format that satisfies clause 36. The board receives security updates, but not in the format APRA expects to see from the board oversight function. When APRA reviews the architecture, each of those gaps becomes a finding. The architectural work is the same in both scenarios. The difference is documentation structure, and it is not obvious from the CPS 234 standard itself what APRA actually expects to see.

What you walk away with

Produce an information asset register that satisfies CPS 234 clause 20 requirements and APRA examiner expectations.
Design a third-party security architecture framework meeting clause 36 obligations, including due diligence documentation and contractual security requirements.
Build a cloud security architecture decision record library that traces each control to a specific CPS 234 clause.
Create a board reporting framework that satisfies APRA's oversight obligation requirements for information security.
Establish a material weakness identification process with notification thresholds calibrated to CPS 234 obligations.

The 12 modules

Module 1. CPS 234 Architecture Obligations

What CPS 234 actually requires a Security Architect to design, clause by clause, versus what most security teams implement. This module maps each CPS 234 clause to the specific architectural decisions it demands: information asset identification, control design rationale, third-party obligations, board reporting, and testing frequency. You finish with a clause-by-clause architecture obligation register that becomes your working document through every subsequent module.

Module 2. Building the Information Asset Register

The information asset register is the first document APRA examiners review. This module builds the register format APRA expects, covering asset identification methodology, criticality classification tiers, control mapping columns, and information sensitivity categories. You design the register schema for your environment, work through the asset inventory logic, and produce the control mapping structure that ties each asset tier to the security architecture decision protecting it.

Module 3. Third-Party Security Architecture and Clause 36

CPS 234 clause 36 requires documented security arrangements for every third-party provider with access to information assets. This module builds the assessment framework: provider classification by access type, due diligence architecture, contractual security requirements, and the notification-obligation decision tree. You produce a third-party security architecture template that documents which controls apply to each provider category and the architectural rationale behind each requirement.

Module 4. Cloud Security Architecture Decision Records

Cloud environments create CPS 234 architecture questions that on-premises references do not answer: shared responsibility mapping, control inheritance documentation, and data residency obligations. This module works through the architecture decisions that satisfy CPS 234 in cloud-hosted environments, producing architecture decision records for three common deployment patterns: SaaS with regulated data access, IaaS compute hosting, and hybrid connectivity to on-premises regulated systems.

Module 5. Network Segmentation and Zone Architecture

The security zone architecture that separates regulated data, corporate systems, and external connectivity is a core CPS 234 expectation. This module designs the zone model, defines control requirements at each boundary, and produces documentation that maps directly to CPS 234 clauses. You build the network security architecture diagram, the zone definition document, and the control rationale record that sits behind the segmentation design.

Module 6. IAM Architecture for CPS 234 Compliance

Identity and access management architecture under CPS 234 requires documented controls over privileged access, third-party access, and access to information assets by criticality tier. This module designs the IAM architecture framework, covering role model design, privileged access management requirements, access certification obligations, and the control mapping. You produce the IAM architecture specification and the access control design document for your regulated environment.

Module 7. Security Testing Scope and APRA Requirements

APRA expects defined testing scope, frequency, and outcome documentation that validates the security architecture. This module builds the testing framework: penetration testing scope aligned to CPS 234 obligations, vulnerability assessment frequency by asset criticality tier, red team exercise scope for critical information assets, and the results documentation format APRA examiners expect. You produce the testing program design and the results reporting template.

Module 8. Incident Architecture and APRA Notification Obligations

CPS 234 imposes specific notification obligations when material information security incidents occur. This module designs the incident response architecture: detection capability requirements mapped to CPS 234, incident classification criteria, internal escalation path, and the APRA notification decision tree. You build the incident classification matrix that determines notification thresholds and the notification documentation format that satisfies APRA's reporting requirements.

Module 9. Resilience Architecture for APRA-Regulated Environments

Business continuity and disaster recovery architecture under CPS 234 requires documented recovery capability for information assets by criticality tier. This module designs the resilience architecture: RTO and RPO targets by asset tier, recovery testing obligations, and the control architecture that enables recovery. You produce the resilience architecture specification and the testing schedule that demonstrates ongoing compliance with CPS 234 obligations as your environment changes.

Module 10. Board and Management Reporting Architecture

APRA requires the board to maintain active oversight of information security, which means the security architecture must generate reporting that satisfies that obligation. This module designs the reporting architecture: key risk indicators, control effectiveness metrics, material weakness identification process, and the reporting format APRA-regulated boards require. You produce the board report template and the underlying data model that populates it from your architecture documentation.

Module 11. Material Weakness Identification and Remediation

When a security architecture gap reaches material weakness threshold, CPS 234 imposes specific notification and remediation obligations. This module builds the material weakness assessment framework: identification criteria calibrated to CPS 234, remediation planning methodology, APRA notification preparation, and the architecture change management process. You produce the material weakness assessment template and the remediation plan format that satisfies APRA's remediation tracking requirements.

Module 12. Architecture Governance and Annual CPS 234 Compliance

Security architecture governance under CPS 234 is ongoing: architecture reviews, change management controls, and annual certification obligations require a sustained process. This module builds the governance framework: architecture review board design, change assessment methodology, the CPS 234 annual review process, and the attestation documentation senior management signs. You produce the architecture governance charter and the annual review process that keeps the security architecture aligned to CPS 234 as the environment evolves.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Preparing for an APRA prudential review and need the information asset register in a format the examiner can follow

A third-party provider has raised a security architecture question that does not have a documented answer

The board is asking for assurance on information security and the current reporting format does not satisfy their CPS 234 oversight obligation

A cloud migration is exposing gaps in the security architecture documentation that were not visible in the on-premises environment

What you get with this course

12 text-based modules delivered in the Art of Service learning environment
Downloadable templates for the information asset register, third-party assessment framework, cloud ADR library, and board reporting format
The hand-built implementation playbook tailored to your APRA-regulated environment and architecture scope

What you will have in hand by Day 1, Week 1, Month 1

Access to all 12 modules from the moment your account is provisioned

Downloadable templates available immediately on module access

Hand-built implementation playbook delivered alongside course access

Before and after

Before

Security architecture is technically sound but not documented in the format CPS 234 requires. APRA reviews generate findings in the information asset register, third-party assessment documentation, and board reporting rather than in the controls themselves.

After

Each CPS 234 architectural obligation has a corresponding document, template, and process. The architecture passes APRA review because the documentation structure matches what APRA examiners expect to find, not because the controls changed.

What happens if you do not address this

APRA material weakness notifications are public. A security architecture that satisfies controls but fails documentation review generates the same prudential finding as a security architecture with actual control gaps. The reputational and regulatory cost is identical.

Who it is for

Security Architects at APRA-regulated financial services institutions, responsible for information security architecture design, third-party security assessment, and the documentation that satisfies CPS 234. Typically 8 to 15 years of security architecture experience, accountable to the CISO, and directly engaged when APRA conducts prudential reviews.

Who this is NOT for. Security engineers focused on implementation rather than architecture. Compliance analysts without architecture accountability. Security leaders at institutions not subject to APRA's information security standard.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Approximately 3 to 4 hours per module, with additional time for template customisation. Most architects complete the core modules within two weeks while working through the implementation templates in parallel.

Why $199 is the right number

APRA publishes guidance that describes CPS 234 obligations but not the architecture patterns that satisfy them. Security architecture frameworks such as SABSA and TOGAF provide methodology but not CPS 234-specific control mapping. This course bridges those two layers: the obligation from the standard, the architecture pattern that satisfies it, and the documentation format that makes it visible to an APRA examiner.

FAQ

Does this cover the current CPS 234 version including recent APRA amendments?

Yes, the module content reflects current CPS 234 obligations including the third-party notification requirements and the board oversight expectations as stated in the current standard.

Is this relevant if we are also subject to other regulatory frameworks alongside CPS 234?

The architecture patterns in this course are designed for APRA-regulated entities. The governance module covers how to manage CPS 234 obligations alongside other regulatory requirements, including how to structure architecture decision records when multiple standards apply.

What if our security architecture is already partially documented?

The course is structured so each module produces a specific artefact. If you already have a partial information asset register or a basic network architecture diagram, the module works through the CPS 234-specific additions rather than starting from scratch.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.