New in the July 2026 issue. For a material arrangement, the entity is relieved of paras 53 and 54, limb (d) of para 55 and limbs (a) and (c) of para 59 where both conditions hold: (a) the provider falls within a category in the Attachment; and (b) the arrangement is on standardised terms (terms drawn up by the provider that the entity has no or almost no power to negotiate or change on matters this standard covers) or is not recorded in a formal agreement. Attachment categories, in summary: government agencies (public bodies administering legislation or delivering public functions, but not government business enterprises); regulators (statutory bodies supervising or enforcing compliance in the financial system); central banks; financial market exchanges (licensed market operators under Corporations Act Part 7.2 and equivalently regulated overseas exchanges); operators of clearing and settlement facilities (licensed under Part 7.3 or equivalent overseas, including superannuation clearing houses on the ATO SuperStream Product register); operators of formally recognised payment systems and schemes under an established oversight framework; and financial messaging infrastructures (including SuperStream gateway operators that have signed an application under the Gateway Network Governance Body MoU). Every other requirement keeps applying, including para 52 due diligence, para 55(a) to (c) and para 59(b). Under para 58 APRA can also, by written notice, exempt an arrangement that fails condition (a) or (b) from the same paragraphs.
APRA CPS 230 Operational Risk Management 57 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of APRA CPS 230 Operational Risk Management your existing evidence covers. Hold NIST Cybersecurity Framework 2.0 and 30 of 87 APRA CPS 230 Operational Risk Management controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 4 were rejected on the NIST Cybersecurity Framework 2.0 pair alone.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.