How APRA CPS 230 and CPS 234 Change Technology Vendor Selection

APRA CPS 230 and CPS 234 both affect how regulated financial institutions choose and manage technology providers, but they do different jobs. CPS 230, which commenced on 1 July 2025, sets requirements for operational risk, business continuity and the management of service providers. CPS 234 sets requirements for information security, including the security of information assets managed by third parties. Together they move vendor selection from a commercial and technical exercise to one that has to produce evidence a regulator may ask to see.

CYBORIUM helps Australian regulated entities run technology sourcing that produces that evidence, through a structured vendor-neutral process. The selected provider pays CYBORIUM a capped fee. The client contracts directly with that provider, and CYBORIUM does not sell, deliver, operate or invoice the technology.

Who the standards apply to

CPS 230 applies to APRA-regulated entities: authorised deposit-taking institutions, general insurers, life insurers, private health insurers and registrable superannuation entity licensees. It replaced earlier outsourcing and business continuity standards. Some requirements apply more lightly to entities that are not significant financial institutions. CPS 234 applies to the same group of regulated entities. Organisations that supply these entities are not directly regulated, but they are increasingly asked to meet the resulting contract and evidence requirements.

What CPS 230 changes for vendor selection

Material service providers

Entities must identify the service providers they rely on for critical operations or that expose them to material operational risk, keep a register of them, and manage them under a documented policy. APRA’s prudential practice guide CPG 230 lists categories it expects to be considered, and many technology services, such as core platforms, cloud hosting and managed security, fall into them.

Risk assessment before the arrangement

Due diligence has to happen before entering an arrangement, not after. For technology purchases, that means asking for financial viability, resilience, subcontractor, data location and exit information during the approach to market, and scoring it alongside capability and price.

Formal agreements

Arrangements with material service providers must be covered by legally binding agreements that address matters such as service levels, notification of disruptions, subcontracting, access for the entity and APRA, business continuity and termination. Settling these terms while more than one provider is still in contention puts the entity in a far stronger position than negotiating them after selection.

Notification, offshoring and transition

CPS 230 includes requirements to notify APRA about material arrangements and additional expectations for arrangements that involve offshoring. Contracts that existed when the standard commenced had until the earlier of their next renewal or 1 July 2026 to comply. Entities should check the current standard and guidance for the exact obligations and timeframes that apply to them.

Concentration and exit

Relying on one provider for several critical operations creates concentration risk. Entities need to understand those dependencies and plan how they would exit or replace a provider. In practice, exit plans and data return terms should be evaluated during selection.

What CPS 234 adds

CPS 234 requires regulated entities to evaluate the information security capability of third parties that manage their information assets, in proportion to the potential consequences of an incident. Entities must notify APRA within 72 hours of becoming aware of a material information security incident, and within 10 business days of becoming aware of a material information security control weakness they cannot remediate in a timely manner. Those obligations stay with the entity, which means providers must be contractually required to notify the entity quickly and provide the evidence it needs.

For vendor selection, this points to asking for independent security assurance such as ISO/IEC 27001 certification or SOC 2 reports, reading their scope, and testing controls where the risk justifies it.

What are the APRA CPS 234 requirements?

CPS 234 applies to APRA-regulated entities and sets minimum information security requirements. In summary, an entity must:

• Clearly define information security roles and responsibilities, with the board ultimately responsible for information security.
• Maintain an information security capability that matches the size and extent of threats to its information assets, including assets managed by related parties and third parties.
• Maintain an information security policy framework that matches its responsibilities.
• Classify its information assets by criticality and sensitivity, including those managed by third parties.
• Put in place controls to protect information assets, in proportion to their criticality and sensitivity.
• Maintain incident detection and response plans, and review and test them at least annually.
• Test the effectiveness of its controls through a systematic testing programme.
• Have internal audit review the design and operating effectiveness of information security controls.
• Notify APRA within 72 hours of a material information security incident, and within 10 business days of a material control weakness it cannot remediate in a timely manner.

For vendor selection the practical consequence is that a provider handling your information assets is inside the standard. Ask for its security assurance, the scope of that assurance, and a contractual duty to notify you fast enough for you to meet the 72 hour deadline. The full text is in APRA Prudential Standard CPS 234.

A selection process that meets both standards

1. Classify the service early: is it, or could it become, a material service provider arrangement?
2. Include CPS 230 and CPS 234 requirements in the approach to market so every provider responds to them.
3. Score resilience, security evidence, subcontracting, data location and exit alongside capability and cost.
4. Negotiate required contract terms before confirming the preferred provider.
5. Record the decision, the risks accepted and the ongoing monitoring plan, and update the service provider register.

How CYBORIUM helps

CYBORIUM can build the requirements into the approach to market, coordinate providers, evaluate security and resilience evidence alongside commercial terms, and prepare a decision record suited to board and regulatory review. The organisation keeps the decision and contracts directly with the selected provider. For a service overview, see APRA CPS 230 due diligence, and for supplier risk more broadly, vendor and supplier risk management.

Updated 15 September 2026. This article is a general summary of APRA prudential standards as they relate to vendor selection. It is not legal or regulatory advice. Refer to the current standards and APRA guidance for the obligations that apply to your entity.

Standards and further reading

Both prudential standards changed what a regulated entity has to be able to show about its suppliers.

• APRA CPS 230. Operational risk management, including material service provider identification and the obligations a board retains.
• APRA CPS 234. Information security obligations, including those that apply to information assets managed by a third party.
• ASD Annual Cyber Threat Report. The threat environment those standards are responding to, in reported numbers.

Last updated: 22 October 2026