CPS 234: The Common Compliance Gaps APRA Is Finding

CPS 234 has been in force since 1 July 2019, yet APRA’s reviews and thematic assessments keep surfacing the same weaknesses. The standard itself is principles-based and relatively short, which is precisely why entities struggle: it demands judgement and evidence rather than a tick-box checklist. The gap is rarely in policy documents; it is in whether the controls actually work and can be proven.

Drawing on APRA’s published observations and our own assessment work with Australian financial firms, this guide sets out the recurring CPS 234 gaps and how to close them.

Gap 1: Third-party and supply-chain assurance

This is consistently the weakest area. CPS 234 explicitly extends an entity’s obligations to information assets managed by third parties, but many firms stop at contractual clauses. They have a clause requiring “appropriate security” and assume that discharges the obligation. APRA’s position is clear: contractual rights are not the same as assurance.

The common failings are:

• No evidence that providers actually maintain the controls promised, beyond a signed contract.
• No visibility over fourth parties — the subcontractors and platforms a provider depends on.
• Right-to-audit clauses that are never exercised.
• Material providers not even identified as holding regulated information assets.

To close it: maintain a register of all third parties that handle your information assets, classify them by criticality, and obtain genuine assurance proportionate to that criticality — independent reports such as SOC 2 or ISO 27001 certification, completed control questionnaires backed by evidence, or your own assessments. Test the providers’ controls as part of your programme, and map the chain down to significant fourth parties. This work dovetails with our broader cyber due diligence approach.

Gap 2: Control testing that is too narrow or too shallow

CPS 234 requires entities to test the effectiveness of their information-security controls through a systematic programme, at a frequency that reflects how quickly assets and threats change. APRA frequently finds testing that is:

• Too narrow — penetration tests of a couple of public-facing systems, with internal, cloud and third-party controls left untested.
• Too shallow — vulnerability scans presented as control testing, when the standard expects validation that controls actually achieve their objective.
• Not feeding back — findings that are reported but never tracked to remediation or used to update the testing scope.

To close it: build a risk-based testing plan covering internal, external, cloud and third-party environments, document why each frequency was chosen, and ensure findings flow into a tracked remediation process. Where systematic testing is warranted, conduct it at least annually and after material change.

Gap 3: Incomplete information asset identification and classification

Every control downstream depends on knowing what you are protecting and how sensitive it is. APRA regularly finds asset inventories that are out of date, omit cloud and SaaS platforms, or apply classification inconsistently. Without accurate classification, you cannot demonstrate that your controls are commensurate with the criticality and sensitivity of each asset — which is the core test CPS 234 applies.

To close it: maintain a living inventory of information assets, including those held by third parties, classify them by criticality and sensitivity, and review the classification when systems change. Tie control strength explicitly to classification so you can show the link.

Gap 4: Roles, responsibilities and board oversight

CPS 234 requires clearly defined and documented information-security roles and responsibilities across the board, senior management, governing bodies and individuals. A frequent gap is a security function that exists in practice but is not formally mandated, resourced or reported to the board. APRA expects the board to be genuinely engaged, not merely receiving an annual slide.

To close it: document the security operating model, define accountabilities at each level, and establish regular, substantive board reporting on security posture, incidents and testing results. For many smaller entities, a virtual CISO provides the accountable senior security leadership the standard expects without the cost of a full-time hire.

Gap 5: Incident response and notification readiness

CPS 234 requires robust incident response, and APRA’s notification obligations are specific: material information-security incidents must be notified to APRA within 72 hours, and material control weaknesses within 10 business days. Firms commonly have a generic incident plan that never mentions these timeframes, has never been tested, and does not define what “material” means for their context.

To close it: build response plans that explicitly address APRA notification triggers and timeframes, define materiality thresholds in advance, and rehearse them through tabletop exercises that include the people who would actually make the call. Practising the decision is as important as documenting the process.

Gap 6: Treating CPS 234 in isolation from CPS 230

With CPS 230 (operational risk management) in effect from 1 July 2025, the third-party and resilience obligations of the two standards overlap heavily. Entities that run them as separate projects duplicate effort and create inconsistent provider registers and risk views. Aligning them — one provider register, one assurance process, one set of materiality definitions — is far more efficient and presents a coherent story to APRA.

Gap 7: Internal audit not providing genuine assurance

CPS 234 expects the entity’s internal audit function to review the design and operating effectiveness of information-security controls, including the testing programme itself. APRA frequently finds internal audit either skipping security entirely, lacking the technical depth to assess it meaningfully, or rubber-stamping management’s own assessment. The result is an assurance layer that provides false comfort to the board.

To close it: ensure internal audit has, or can call on, real information-security competence; have it independently evaluate the adequacy of control testing rather than just confirming tests were run; and report its findings to the board alongside management’s view. Where internal capability is thin, co-sourcing the security audit to a specialist is a legitimate and common approach.

Gap 8: Security capability not keeping pace with change

CPS 234 requires an entity to maintain an information-security capability commensurate with the size and extent of threats and enabling it to operate securely. The common failing is a static capability against a moving target: the business adopts new cloud services, opens new digital channels or completes an acquisition, but the security team, tooling and controls do not scale with it. APRA looks for evidence that capability is reassessed when the risk profile changes — not merely once at policy sign-off.

To close it: tie security capability reviews to material business change (new platforms, mergers, new customer channels), reassess resourcing and tooling against the current threat environment, and document the link between the change and the capability response. An acquisition in particular should trigger a security due-diligence and integration assessment rather than an assumption that the acquired entity’s controls are adequate.

How to get ahead of your next review

The pattern in APRA’s findings is consistent: the documentation usually exists, but the evidence that controls work, especially across third parties, does not. Closing these gaps is less about new policy and more about assurance, testing and demonstrable oversight. Our CPS 234 explainer covers the full obligations, and a targeted independent gap assessment is the quickest way to find where you stand.

A practical way to prepare is to assemble, for each requirement, the evidence you would hand an APRA reviewer today, and be honest about where that evidence is a policy document rather than proof a control operated. The gaps will cluster exactly where this guide predicts: third-party assurance, the breadth and depth of control testing, asset classification, and the quality of board reporting. Prioritising remediation by the criticality of the affected information assets, rather than by what is easiest to fix, is what turns a gap assessment into a defensible improvement programme. Aligning that programme with your Essential Eight uplift and any PCI work avoids running three parallel projects over the same controls.

CISO Advisory helps APRA-regulated entities close CPS 234 gaps and align them with CPS 230 and PCI obligations under a single control framework. To arrange an independent review, call 07 2112 8502 or reach us through our contact page.