APRA’s Prudential Standard CPS 234 makes information security a board-level obligation for banks, insurers and superannuation trustees. Before an entity can size its controls, respond to incidents or commission independent testing, it has to know what it is protecting. That starts with identifying and classifying information assets, and it is the foundation on which the rest of CPS 234 stands or falls.
Why classification is the first control, not the paperwork
CPS 234 requires APRA-regulated entities to classify their information assets by criticality and sensitivity, and to maintain information security capability commensurate with the threats and vulnerabilities those assets face. The word that matters is commensurate. You cannot apply proportionate controls if you do not know which systems would cause material harm if they were compromised, and which data would trigger privacy breaches or regulatory consequences if exposed.
In practice, classification is the mechanism that turns a finite security budget into defensible decisions. It tells you where to put your strongest authentication, your tightest monitoring and your most rigorous testing. Treat it as a living control rather than a compliance artefact, and the standard becomes far easier to satisfy.
What counts as an information asset
Under CPS 234, an information asset is information and the information technology used to handle it. That is deliberately broad. It captures more than databases and the personal information they hold:
- Data — customer records, member account balances, claims data, policy details, transaction histories and internal financial information.
- Applications — core banking platforms, policy administration systems, member portals, payments systems and the integrations between them.
- Infrastructure — servers, networks, cloud tenancies, identity providers and endpoints.
- Supporting assets — backups, configuration data, encryption keys, monitoring tools and the documentation that describes how systems work.
Critically, CPS 234 extends to information assets managed by related parties and third parties. A superannuation fund whose administration is outsourced, or an insurer relying on a cloud platform, still owns the obligation to identify and classify those assets and to ensure they are protected appropriately. The control may be operated by someone else, but the accountability is not transferable.
Building the information asset register
The register is where identification becomes tangible. A defensible register is comprehensive enough that APRA can see you understand your environment, and practical enough that your teams actually keep it current. Aim to capture, for each asset or asset group:
- A clear description and business owner.
- The criticality rating (how much harm would result from loss of availability or integrity).
- The sensitivity rating (how much harm would result from unauthorised disclosure).
- Where the asset lives and who manages it, including third-party and related-party arrangements.
- The controls applied and any dependencies on other assets.
Resist the temptation to inventory every individual server and file. Group assets sensibly, classify the group, and reserve individual treatment for genuinely high-stakes systems. An over-engineered register that nobody maintains is worse than a focused one that stays accurate.
Setting criticality and sensitivity tiers
Most APRA-regulated entities settle on three or four tiers. A workable model separates two dimensions and then combines them:
- Criticality considers the operational and financial impact of an asset becoming unavailable or being tampered with. A core ledger or payments rail sits at the top; an internal staff intranet sits lower.
- Sensitivity considers the consequence of disclosure. Member personal information, financial data and authentication secrets rank high; published marketing material ranks low.
Combine the two to assign a protection profile. The highest tier should attract your strongest preventive and detective controls, the most frequent testing, and the tightest access. Lower tiers can be protected more economically. This is exactly the proportionality CPS 234 is asking for, and it aligns naturally with the layered mitigations in the Essential Eight and with the asset-based risk approach in ISO 27001.
Mapping controls to classifications
Classification is only useful if it changes how you protect assets. Build a control matrix that states, for each tier, the minimum expectations for access management, encryption, logging, backup, patching and monitoring. When a new system is proposed, its classification immediately tells the project team which controls are mandatory. This removes guesswork, accelerates delivery and gives your assurance teams a clear baseline to test against.
It also makes incident response faster. When something goes wrong, the register tells responders the criticality and sensitivity of the affected asset, which directly informs whether an incident is material and therefore notifiable to APRA. Sound classification is the quiet enabler behind every other CPS 234 obligation.
Keeping the register current
APRA expects classification to reflect reality, not a snapshot from two years ago. The most reliable way to keep the register accurate is to wire it into existing processes rather than running a separate annual project:
- Make classification a mandatory step in change management and project approval.
- Trigger a review whenever a vendor changes, a system is decommissioned or an acquisition occurs.
- Reconcile the register against discovery tooling periodically to catch shadow IT and forgotten systems.
- Review the whole register at least annually, with sign-off from asset owners.
Where third parties hold critical or sensitive assets, fold classification into your vendor due diligence and contractual assurance so you can demonstrate, not just assert, that protection is commensurate.
Handling shared and composite assets
Real environments rarely divide cleanly into neat assets. A single platform might process both highly sensitive member data and routine reference information; a shared database might underpin a critical payments function and a low-stakes reporting tool at the same time. The principle to apply is straightforward: classify to the highest level of any data or function the asset handles. A system that touches top-tier information is a top-tier system, even if most of what it does is mundane. Trying to apply mixed classifications within a single component usually creates gaps that attackers and auditors both find.
The same logic applies to dependencies. If a low-classified system holds the credentials, configuration or backups for a high-classified one, it inherits that criticality. Mapping these dependencies in the register is what turns classification from a flat list into an accurate picture of where real risk concentrates.
Evidence APRA expects to see
Classification is not only an internal control; it is something you must be able to demonstrate to APRA and to internal audit. A defensible classification capability typically produces:
- A documented classification methodology that defines the tiers and the criteria for each.
- The information asset register itself, current and owned.
- The control matrix linking each tier to required protections.
- Evidence of regular review, including sign-off by asset owners and dates of the last review.
- Records showing third-party and related-party assets are captured and assessed.
If you can produce these artefacts and show they genuinely drive decisions, you are well placed. If classification exists only as an idea in people’s heads, you have a gap regardless of how well the underlying controls happen to perform.
Common pitfalls to avoid
Several problems show up repeatedly. The first is treating classification as an IT exercise; business owners understand criticality and sensitivity far better than infrastructure teams, and they must be involved. The second is ignoring third-party assets, which is a direct CPS 234 gap APRA looks for. The third is a register that is never used, where classifications exist on paper but do not drive any control decision. If your tiers do not change behaviour, they are decoration. A fourth, subtler trap is over-classification, where everything is rated critical to be safe; this dilutes the meaning of the top tier and stretches scarce resources across assets that do not warrant them. Classification only works when it genuinely discriminates between what matters most and what matters least.
Where to start
If your register is incomplete or your tiers are not driving controls, prioritise your most material systems first, get business owners to agree criticality and sensitivity, and build the control matrix that connects classification to action. For a broader view of how this obligation sits within the standard, see our CPS 234 explained guide and our CPS 234 advisory services.
CISO Advisory works with APRA-regulated entities to build defensible asset registers and classification frameworks that satisfy CPS 234 without drowning teams in process. If you would like help, call us on 07 2112 8502 or get in touch through our Virtual CISO service.
Frequently asked questions
What is an information asset under CPS 234?
An information asset is information and the information technology used to handle it. Under CPS 234 this includes software, hardware, data and supporting systems, whether managed by the entity or by a related party or third party such as a cloud provider or outsourced administrator.
How granular should asset classification be?
Granular enough to drive meaningful control decisions, but not so fine that the register becomes unmaintainable. Most APRA-regulated entities use three to four tiers based on criticality and sensitivity, then map controls to each tier rather than to individual assets.
Does CPS 234 require classifying third-party assets?
Yes. CPS 234 explicitly extends to information assets managed by related parties and third parties. You must identify them, understand their criticality and sensitivity, and ensure protection commensurate with that classification even when a vendor operates the control.
How often should the asset register be reviewed?
At minimum annually, and whenever material change occurs, such as a new system, an acquisition, a vendor change or a regulatory shift. APRA expects classification to remain current, so most entities embed review into change management rather than relying on a once-a-year exercise.
Who owns information asset classification?
The board is ultimately accountable, but day-to-day ownership usually sits with business asset owners supported by security and risk teams. Clear ownership matters because the classification drives every downstream control decision and must be defensible to APRA.
Need this handled for your organisation?
Confidential and no obligation. We respond the same business day — on-site same day / next business day, or remote, Australia-wide. Prefer to talk now? Call us 24/7 on 07 2112 8502.