Home / Rules / APRA CPS 234 Information Security
APRA CPS 234 Information Security: the rules AI agent steps rest on
- Edition
- CPS 234, July 2019 (in force 1 July 2019); no later issue
- Checked current
- 2026-10-07
- Official source
- https://handbook.apra.gov.au/standard/cps-234
| Rule | Our statement | Steps that cite it |
|---|---|---|
| APRA CPS 234 para 16 (third-party security capability) | Where a related party or third party manages any of the entity's information assets, the entity assesses that party's information security capability, to a depth that matches the possible consequences of an incident touching those assets. A footnote makes this apply to every such party, not only those supplying outsourced material business activities covered by CPS 231 or SPS 231. | KC-05 S6 The provider afterwards; KC-07 S5 Security capability before reliance |
| APRA CPS 234 para 22 (design of third-party controls) | Where a related or third party manages the entity's information assets, the entity evaluates how that party's security controls protecting those assets are designed. A footnote confirms this reaches every such party, not only CPS 231 or SPS 231 material outsourcing. | KC-05 S6 The provider afterwards; KC-07 S5 Security capability before reliance |
| APRA CPS 234 para 35 (notify APRA within 72 hours) | The entity must tell APRA promptly, and at the latest within 72 hours of becoming aware, of any information security incident that either (a) had, or could have had, a material financial or non-financial effect on the entity itself or on the interests of its depositors, policyholders, beneficiaries or other customers (the impact limb), or (b) has already been notified to another regulator in Australia or overseas. A footnote covers incidents not already reported under CPS 231, SPS 231, CPS 232 or SPS 232, and counts domestic government agencies and international regulators as other regulators. | KC-05 S1 CPS 234: notify APRA?; KC-05 S5 Who lodges with APRA? |