APRA CPS 234 Compliance Checklist for Enterprise Banks (2026)

Summary

• APRA is now actively enforcing its CPS 234 standard, shifting non-compliance from a reputational risk to a direct regulatory consequence for financial institutions.
• Regulators are focusing on two key areas: comprehensive management of third-party information assets and the ability to demonstrate ongoing, continuous control effectiveness.
• Organizations must move beyond manual, point-in-time checks by adopting technology for automated vendor assessments, continuous monitoring, and streamlined incident reporting.
• A platform with dedicated modules for Third-Party Risk Management (TPRM) and Continuous Controls Monitoring (CCM) can automate evidence collection and provide the continuous assurance APRA expects.

The Australian Prudential Regulation Authority (APRA) has moved well beyond issuing guidance on Prudential Standard CPS 234. Since 2022, APRA-regulated banks, insurers, and superannuation funds have been receiving Letters of Findings and formal remediation notices for compliance gaps. Non-compliance is no longer merely a reputational risk. It carries direct regulatory consequences.

For CISOs and Heads of IT Risk, the message is unambiguous: an actionable APRA CPS 234 compliance checklist is now a baseline operational requirement, not a nice-to-have. The two areas generating the most enforcement attention are third-party information asset management and ongoing control effectiveness testing. Both require systematic tooling to demonstrate continuous assurance, not just point-in-time snapshots. This checklist covers what your technology stack needs to address each of the five core software-addressable requirements and where most institutions are currently falling short.

APRA CPS 234 Compliance Checklist: 5 Key Requirements

The official CPS 234 standard, effective 1 July 2019, sets out obligations across governance, capability, controls, incident management, and testing. Readers should consult APRA's prudential practice guides for the specific obligations applicable to their entity. The five requirements below are where technology platforms can make the most material difference.

1. Defined Information Security Roles and Responsibilities

What it requires: The board holds ultimate accountability for the institution's information security posture. CPS 234 requires that roles and responsibilities for information security are clearly articulated across the board, senior management, governing bodies, and all staff, including escalation paths and reporting structures.

According to Riskonnect's compliance guide, active board oversight is a non-negotiable element of this requirement.

What your platform needs: A governance, risk, and compliance (GRC) platform that documents role assignments, maintains immutable audit trails, and manages approval workflows for security governance decisions. Without this, demonstrating accountability to APRA during a review is extremely difficult.

AI automation potential: AI can monitor policy adherence continuously and flag deviations in assigned responsibilities before they become findings. This addresses a common CISO pain point: building a board-ready evidence trail without manual effort.

2. Maintained Information Security Capability

What it requires: Regulated entities must maintain an information security capability that is proportionate to the size, nature, and complexity of their operations and to the evolving threat environment. This includes a living policy framework and ongoing cyber risk assessments, as outlined by Cimcor's CPS 234 checklist. The capability must evolve as threats change; a static posture will not satisfy APRA.

What your platform needs: A centralised cyber risk register with tracked key risk indicators (KRIs), connected to threat intelligence feeds. This helps quantify risk in financial terms, a necessity when justifying investment to boards who ask about the cost of accepting risk versus mitigating it.

AI automation potential: AI can accelerate risk assessments by analysing large threat datasets and surfacing emerging vulnerabilities faster than manual teams, keeping the institution's capability picture current.

3. Controls Over Information Assets (Including Third Parties)

What it requires: This is the most operationally complex item on any APRA CPS 234 compliance checklist. Institutions must implement controls to protect information assets, with control rigour proportionate to asset criticality and sensitivity.

Critically, this obligation extends to information assets managed by third-party service providers. As Perforce notes, entities must assess the information security capabilities of every relevant third party, not merely collect attestations.

What your platform needs: A dedicated Third-Party Risk Management (TPRM) module that automates vendor assessments, tracks performance against security requirements, and maintains a current, classified inventory of third-party information assets. Static spreadsheet-based inventories do not satisfy this CPS 234 compliance requirement. Explore Cyber Sierra's TPRM platform for an AI-driven approach to this obligation.

AI automation potential: AI can analyse vendor questionnaires, contractual obligations, and external threat intelligence to produce continuous, data-driven risk ratings for each third party, replacing annual point-in-time assessments with ongoing visibility.

4. Incident Management and APRA Notification

What it requires: Institutions must maintain plans to detect and respond to information security incidents. APRA requires notification of any material incident within 72 hours. Any material information security control weakness that cannot be remediated promptly must be reported to APRA within 10 business days, per Cimcor's requirements overview. These are hard deadlines with no grace period.

What your platform needs: Automated incident detection, triage, escalation, and APRA notification workflows. Manual processes involving email chains and spreadsheets introduce unacceptable latency against a 72-hour window.

AI automation potential: AI can correlate events across systems to identify material incidents faster, pre-populate draft APRA notifications, and reduce the risk of a missed reporting obligation.

5. Regular and Independent Control Effectiveness Testing

What it requires: CPS 234 mandates a systematic program for testing the effectiveness of information security controls, conducted by appropriately skilled and functionally independent specialists. Testing must also cover controls relating to third-party service providers, according to Riskonnect. APRA expects evidence — not assertions — that controls are working.

What your platform needs: A Continuous Controls Monitoring (CCM) module that goes well beyond annual or quarterly sampling. It should collect evidence automatically from across the technology stack and validate control effectiveness in near real-time. Cyber Sierra's CCM platform is purpose-built for this obligation.

AI automation potential: AI can analyse collected evidence at scale, identify gaps instantly, and map them directly to CPS 234 compliance requirements. This helps move beyond sample-based approaches that can leave institutions exposed.

Where Australian Banks and Insurers Typically Fall Short

Working through an APRA CPS 234 compliance checklist in theory and demonstrating it in practice are two different things. APRA's enforcement activity has revealed consistent gaps across regulated entities, and they cluster around the same four areas.

• Stale third-party information asset inventories. Many institutions cannot produce a current, complete inventory of information assets managed by third parties. Inventories are often built once and never refreshed, meaning new vendors, changed service scopes, and decommissioned relationships are not reflected. This directly undermines the third-party control obligation at the core of the CPS 234 checklist.
• Point-in-time control testing. Annual penetration tests and quarterly control samples leave significant visibility gaps between assessments. APRA expects institutions to demonstrate that controls are operating effectively on an ongoing basis. Periodic sampling provides a snapshot, not assurance. This is the gap that makes a continuous controls monitoring capability essential rather than optional for meeting CPS 234 compliance requirements.
• Evidence collected but not reviewed. Compliance teams frequently collect large volumes of evidence to satisfy auditors, but that evidence is not systematically correlated or reviewed for control weaknesses. Files accumulate in shared drives, anomalies go undetected, and findings surface only when APRA or an external auditor looks closely. This is the operational risk of compliance-as-documentation rather than compliance-as-assurance.
• Manual incident notification workflows. Despite the 72-hour material incident notification requirement being well understood, many institutions still rely on manual escalation processes. When an incident occurs, the clock starts immediately. A workflow dependent on human coordination across teams without automated detection and templated notification puts the institution at material risk of a late report to APRA.

These are not theoretical gaps. They represent the specific findings that have appeared in APRA's enforcement correspondence with regulated entities. An APRA information security checklist is only as useful as the systems and processes behind it.

APRA CPS 234 Compliance Software for Enterprise Banks

Selecting the right APRA CPS 234 compliance software is a strategic decision for any enterprise bank or insurer. The platforms below represent the main options available in the market, assessed against the three dimensions that matter most for APRA-regulated entities: CPS 234 coverage depth, Australian data residency, and AI capability.

1. Cyber Sierra

CPS 234 coverage: The platform is purpose-built to address the hardest CPS 234 compliance requirements: third-party information asset management and continuous control testing. The TPRM module uses AI to help automate third-party due diligence at scale, replacing manual questionnaire cycles with continuous vendor risk intelligence. The CCM module is designed to provide comprehensive control test coverage and operates much faster than manual methods.

Deployment (AU data residency): Cyber Sierra can be deployed within the customer's own cloud environment (AWS, Azure, or GCP tenancy in Australia). This eliminates cross-border data transfer concerns entirely, which is a critical differentiator for APRA-regulated entities subject to data sovereignty requirements. No data leaves the institution's controlled environment.

AI capabilities: AI is embedded across both the TPRM and CCM modules. It automates evidence collection, gap analysis, vendor risk scoring, and control validation continuously, not just at audit time. For an enterprise bank managing hundreds of third-party relationships and thousands of controls, this is the difference between a defensible compliance posture and a reactive one.

2. Vanta

CPS 234 coverage: Vanta provides strong automation for core compliance tasks and supports a broad range of frameworks. However, its product positioning and feature set are primarily oriented toward SMB and mid-market technology companies. Enterprise banks with complex third-party ecosystems and multi-layered control environments are likely to find the APRA CPS 234 checklist coverage insufficient for their scale and the depth of evidence APRA now expects.

Deployment (AU data residency): Vanta operates as a cloud-based SaaS product. Customer data is processed on Vanta's infrastructure, which may create data sovereignty considerations for Australian regulated entities depending on where data is hosted and processed.

AI capabilities: Vanta uses automation to monitor compliance status against selected frameworks and can surface control gaps. Its AI functionality is focused on framework mapping and automated evidence collection rather than deep TPRM or CCM workflows.

3. UpGuard

CPS 234 coverage: UpGuard is primarily a cybersecurity posture and third-party risk rating platform. It addresses the external-facing component of the APRA information security checklist: specifically, the requirement to assess third-party information security capabilities. It provides continuous monitoring of vendors' externally observable security posture, which is a useful input to a third-party risk program.

Deployment (AU data residency): UpGuard operates as a cloud-based SaaS platform. Australian data residency options should be confirmed directly with the vendor for regulated entity use cases.

AI capabilities: UpGuard automates the generation of external security ratings and surfaces third-party risk indicators. Its AI capabilities are concentrated in the vendor risk scoring and breach detection space rather than broader GRC or control testing workflows.

4. ServiceNow IRM

CPS 234 coverage: ServiceNow's Integrated Risk Management (IRM) module is a comprehensive enterprise GRC platform with broad capabilities spanning operational risk, compliance, and audit management. It can be configured to support CPS 234 compliance requirements, but configuration is substantial. Institutions typically require specialist implementation partners and extended deployment timelines to build CPS 234-specific workflows.

Deployment (AU data residency): ServiceNow offers flexible cloud deployment options, including configurations that can address Australian data residency requirements. This should be validated against the institution's specific sovereignty obligations.

AI capabilities: ServiceNow Now Intelligence integrates AI for generating risk insights, automating workflow tasks, and surfacing anomalies within its GRC modules. The AI capability is general-purpose rather than purpose-built for information security compliance obligations.

5. Riskonnect

CPS 234 coverage: Riskonnect offers an integrated GRC and operational risk platform that can be tailored to address CPS 234 compliance requirements. Its third-party risk management solution and GRC software provide coverage across policy management, risk assessment, and compliance reporting. Configuration for APRA-specific obligations requires upfront investment.

Deployment (AU data residency): Riskonnect provides cloud-based deployment that can be configured to meet Australian data sovereignty requirements. Specific hosting arrangements should be confirmed with the vendor for APRA-regulated entity use cases.

AI capabilities: Riskonnect provides advanced analytics and risk reporting features. Its AI capabilities support risk aggregation and insight generation across its GRC modules, with a focus on enterprise risk management rather than information security-specific automation.

Move From Checklists to Continuous Assurance

APRA's enforcement shift makes it clear that a compliance checklist is just the start. The real test is your ability to produce on-demand evidence that your security controls are effective, especially for information assets managed by third parties. This requires moving beyond manual, point-in-time assessments.

The two most critical takeaways are that third-party risk is your risk and that continuous assurance is mandatory. Annual audits and quarterly samples are no longer enough; APRA expects proof that controls are working continuously.

If your current tools rely on spreadsheets and manual follow-ups, you have a critical gap. Cyber Sierra was built to provide the continuous assurance APRA demands, using AI to automate TPRM and CCM. To see how it replaces reactive, manual processes with a defensible compliance posture, book a personalized demo.

Frequently Asked Questions

What is APRA CPS 234?

APRA CPS 234 is a prudential standard that sets out minimum information security requirements for all APRA-regulated entities. Its purpose is to ensure institutions are resilient against information security incidents by maintaining robust security controls and capabilities.

Why is CPS 234 compliance so important now?

Compliance is critical because APRA is now actively enforcing the standard, issuing formal remediation notices for gaps. Non-compliance has shifted from being a reputational risk to carrying direct regulatory consequences, making it a fundamental operational requirement.

What are the biggest challenges in complying with CPS 234?

The most significant challenges are managing information security for assets held by third parties and conducting ongoing control effectiveness testing. Many firms struggle with outdated vendor inventories and periodic manual tests, which do not meet APRA's expectation for continuous assurance.

How does CPS 234 apply to third-party vendors?

CPS 234 extends an entity's security obligations to information assets managed by third-party service providers. You must assess the information security capabilities of your vendors and ensure their controls are adequate, rather than simply collecting attestations.

What is the deadline for reporting a security incident under CPS 234?

You must notify APRA of a material information security incident within 72 hours. Furthermore, any material information security control weakness that you cannot remediate in a timely manner must be reported to APRA within 10 business days. These are strict deadlines.

How can AI help with APRA CPS 234 compliance?

AI automates continuous assurance processes required by CPS 234. It can analyse vendor risk data, collect and validate control evidence in near real-time, and identify compliance gaps instantly. This replaces manual, sample-based testing with comprehensive, ongoing monitoring.