APRA CPS 234

Australia

v2019

10 domains

24 controls

Australian Prudential Regulation Authority Information Security Standard

Verified

APRA CPS 234 is a compliance framework from Australia with 10 domains and 24 controls that map to 223 other frameworks. The largest domains are Testing Control Effectiveness (4 controls), Incident Management (3 controls), Internal Audit (3 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (10)

APRA Notification

2 controls

Controls in the APRA Notification domain of APRA CPS 234 — 2 controls
Code	Title	Description
CPS234-35	APRA Notification of Material Incidents within 72 Hours	APRA must be notified as soon as possible and no later than 72 hours after the entity becomes aware of an incident that...
CPS234-36	APRA Notification of Material Control Weakness within 10 Business Days	APRA must be notified as soon as possible and no later than 10 business days after the entity becomes aware of a materia...

Implementation of Controls

2 controls

Controls in the Implementation of Controls domain of APRA CPS 234 — 2 controls
Code	Title	Description
CPS234-21	Implementation of Information Security Controls	Controls protecting information assets must be implemented in a timely way and sized to the vulnerabilities and threats,...
CPS234-30	Detection and Response Mechanisms	The entity must have robust mechanisms to detect information security incidents and respond to them in a timely way.

Incident Management

3 controls

Controls in the Incident Management domain of APRA CPS 234 — 3 controls
Code	Title	Description
CPS234-32	Annual Review and Testing of Response Plans	Information security response plans must be reviewed and tested annually to confirm they remain effective and fit for pu...
CPS234-P24	Information Security Response Plans	The entity must maintain response plans covering the information security incidents it considers could plausibly occur.
CPS234-P25	Response Plan Content and Escalation Mechanisms	Response plans must set out the mechanisms for managing every stage of an incident from detection through to post incide...

Information Asset Identification and Classification

1 controls

Controls in the Information Asset Identification and Classification domain of APRA CPS 234 — 1 controls
Code	Title	Description
CPS234-20	Information Asset Classification	Information assets, including those held by related parties and third parties, must be classified by criticality and sen...

Information Security Capability

2 controls

Controls in the Information Security Capability domain of APRA CPS 234 — 2 controls
Code	Title	Description
CPS234-15	Information Security Capability	The entity must maintain an information security capability sized to the threats facing its information assets and suffi...
CPS234-P17	Active Maintenance of Capability Against Change	The entity must actively maintain its information security capability as vulnerabilities and threats change, including c...

Internal Audit

3 controls

Controls in the Internal Audit domain of APRA CPS 234 — 3 controls
Code	Title	Description
CPS234-25	Internal Audit Review of Information Security Controls	Internal audit activities must include review of the design and operating effectiveness of information security controls...
CPS234-27	Internal Audit Assessment of Third Party Control Assurance	Internal audit must assess the control assurance provided by a related party or third party where an incident affecting...
CPS234-P33	Skill of Personnel Providing Control Assurance	The entity must ensure that information security control assurance is provided by personnel who are appropriately skille...

Policy Framework

2 controls

Controls in the Policy Framework domain of APRA CPS 234 — 2 controls
Code	Title	Description
CPS234-19	Information Security Policy Framework	The entity must maintain an information security policy framework proportionate to its exposure to vulnerabilities and t...
CPS234-P19	Policy Direction to All Responsible Parties	The information security policy framework must give direction on the responsibilities of every party obliged to maintain...

Roles and Responsibilities

2 controls

Controls in the Roles and Responsibilities domain of APRA CPS 234 — 2 controls
Code	Title	Description
CPS234-13	Board Responsibility for Information Security	The Board carries ultimate responsibility for the entity information security and must ensure it is maintained in propor...
CPS234-14	Definition of Information Security Roles and Responsibilities	Information security roles and responsibilities must be clearly defined for the Board, senior management, governing bodi...

Testing Control Effectiveness

4 controls

Controls in the Testing Control Effectiveness domain of APRA CPS 234 — 4 controls
Code	Title	Description
CPS234-22	Systematic Control Testing Program	Control effectiveness must be tested through a systematic program whose nature and frequency reflect the rate of change...
CPS234-28	Escalation of Unremediated Testing Deficiencies	Testing results that identify control deficiencies which cannot be remediated in a timely way must be escalated and repo...
CPS234-P30	Independence and Skill of Testing Personnel	Testing must be carried out by specialists who are appropriately skilled and functionally independent of the activity be...
CPS234-P31	Annual Review of Testing Program Sufficiency	The sufficiency of the testing program must be reviewed at least annually, and also whenever there is a material change...

Third Party Arrangements

3 controls

Controls in the Third Party Arrangements domain of APRA CPS 234 — 3 controls
Code	Title	Description
CPS234-16	Assessment of Related Party and Third Party Capability	Where a related party or third party manages information assets, the entity must assess that party information security...
CPS234-P22	Evaluation of Third Party Control Design	Where a related party or third party manages the entity information assets, the entity must evaluate the design of that...
CPS234-P28	Assessment of Reliance on Third Party Control Testing	Where the entity relies on a related party or third party testing of controls over its information assets, it must asses...

Your Compliance Coverage

If you comply with APRA CPS 234, you already cover:

NIS2 Directive

100%

24 controls mapped

Compare →

NIST SP 800-161 Rev 1

100%

24 controls mapped

Compare →

FedRAMP High

100%

24 controls mapped

Compare →

+ 220 more: FedRAMP Moderate (100%), NIST SP 800-53 Rev 5 MODERATE (100%)

See all 223 mapped frameworks ↓

Maps to 223 other frameworks

24 total controls

NIS2 Directive

24 source controls mapped|20 target controls covered

100%

NIST SP 800-161 Rev 1

24 source controls mapped|38 target controls covered

100%

FedRAMP High

24 source controls mapped|40 target controls covered

100%

FedRAMP Moderate

24 source controls mapped|41 target controls covered

100%

NIST SP 800-53 Rev 5 MODERATE

24 source controls mapped|38 target controls covered

100%

NIST SP 800-53 Revision 5.1 HIGH

24 source controls mapped|38 target controls covered

100%

NIST SP 800-53 Rev 5

24 source controls mapped|49 target controls covered

100%

ISO 27002:2022

24 source controls mapped|26 target controls covered

100%

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1

24 source controls mapped|49 target controls covered

100%

SOC 2

24 source controls mapped|30 target controls covered

100%

ISO 27001:2022

24 source controls mapped|27 target controls covered

100%

NIST Cybersecurity Framework 2.0

24 source controls mapped|56 target controls covered

100%

C5 (Germany)

24 source controls mapped|35 target controls covered

100%

PCI DSS 4.0

23 source controls mapped|38 target controls covered

96%

NIST SP 800-53 Rev 5 LOW

23 source controls mapped|33 target controls covered

96%

HIPAA Security Rule

22 source controls mapped|23 target controls covered

92%

APRA CPS 230 Operational Risk Management

22 source controls mapped|34 target controls covered

92%

NIST SP 800-66 Rev 2

21 source controls mapped|16 target controls covered

88%

CIS Controls v8

21 source controls mapped|37 target controls covered

88%

NIST SP 800-171 Rev 3

21 source controls mapped|23 target controls covered

88%

CMMC 2.0

19 source controls mapped|17 target controls covered

79%

Azure Security Benchmark

15 source controls mapped|25 target controls covered

63%

ANSSI Guide d'hygiene informatique (42 mesures, v2.0)

14 source controls mapped|11 target controls covered

58%

ISO 22301:2019

13 source controls mapped|13 target controls covered

54%

Australia My Health Records Act 2012

12 source controls mapped|8 target controls covered

50%

ISO/IEC 42001:2023

8 source controls mapped|6 target controls covered

33%

Protective Security Policy Framework (PSPF) Release 2024

6 source controls mapped|2 target controls covered

25%

PSD2 SCA

6 source controls mapped|4 target controls covered

25%

OSFI B-13

6 source controls mapped|5 target controls covered

25%

Open Banking Security

6 source controls mapped|3 target controls covered

25%

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security

6 source controls mapped|3 target controls covered

25%

MTCS (Singapore)

6 source controls mapped|3 target controls covered

25%

Monetary Authority of Singapore Technology Risk Management Guidelines

6 source controls mapped|3 target controls covered

25%

HKMA SPM

6 source controls mapped|2 target controls covered

25%

HKMA Cyber Resilience Assessment Framework (C-RAF)

6 source controls mapped|3 target controls covered

25%

GLBA

6 source controls mapped|3 target controls covered

25%

FFIEC Cybersecurity Assessment Tool (CAT)

6 source controls mapped|4 target controls covered

25%

PCI PIN Security

6 source controls mapped|9 target controls covered

25%

PCI SSF

6 source controls mapped|9 target controls covered

25%

PCI P2PE

6 source controls mapped|9 target controls covered

25%

FFIEC IT Examination Handbook

6 source controls mapped|9 target controls covered

25%

SOC for Cybersecurity - Cybersecurity Risk Management Examination

6 source controls mapped|5 target controls covered

25%

Security of Critical Infrastructure Act 2018 (SOCI)

6 source controls mapped|8 target controls covered

25%

SSAE 18 - Attestation Standards (SOC Reporting)

6 source controls mapped|4 target controls covered

25%

Singapore Government Instruction Manual on ICT&SS Management (IM8)

6 source controls mapped|5 target controls covered

25%

APPI

5 source controls mapped|6 target controls covered

21%

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements

4 source controls mapped|4 target controls covered

17%

UK AI Regulation Framework

4 source controls mapped|2 target controls covered

17%

SASB Standards

4 source controls mapped|6 target controls covered

17%

OECD AI Principles

4 source controls mapped|2 target controls covered

17%

O-RAN WG11 Security Specification

4 source controls mapped|2 target controls covered

17%

NRF Cybersecurity and Data Privacy Framework (National Retail Federation)

4 source controls mapped|3 target controls covered

17%

NIST Privacy Framework

4 source controls mapped|5 target controls covered

17%

NIS2 Directive Implementing Acts

4 source controls mapped|2 target controls covered

17%

NERC CIP

4 source controls mapped|2 target controls covered

17%

Japan AI Guidelines

4 source controls mapped|3 target controls covered

17%

IRM Enterprise Risk Management Framework (Institute of Risk Management)

4 source controls mapped|2 target controls covered

17%

IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)

4 source controls mapped|2 target controls covered

17%

IEEE 7000

4 source controls mapped|2 target controls covered

17%

IEEE 1686

4 source controls mapped|2 target controls covered

17%

FedRAMP Rev 5

4 source controls mapped|3 target controls covered

17%

ISO/IEC 38500:2024 - Governance of IT

4 source controls mapped|2 target controls covered

17%

BS 65000:2014 - Guidance on Organizational Resilience

4 source controls mapped|3 target controls covered

17%

API 1164

4 source controls mapped|4 target controls covered

17%

Telecommunications Sector Security Reforms (TSSR)

4 source controls mapped|2 target controls covered

17%

EASA Part-IS - Information Security in Aviation

4 source controls mapped|6 target controls covered

17%

ISO 27019

4 source controls mapped|4 target controls covered

17%

TISAX - Trusted Information Security Assessment Exchange

4 source controls mapped|3 target controls covered

17%

IEC 62443

4 source controls mapped|4 target controls covered

17%

NIST SP 1800-32

4 source controls mapped|4 target controls covered

17%

ISO 22320:2018

4 source controls mapped|4 target controls covered

17%

South Korea ISMS-P

4 source controls mapped|2 target controls covered

17%

ISO 28001:2007 Supply Chain Security Management

4 source controls mapped|2 target controls covered

17%

Annex 11 to EU GMP - Computerised Systems

4 source controls mapped|2 target controls covered

17%

ASIC Cyber Resilience Good Practices

4 source controls mapped|3 target controls covered

17%

ASD Strategies to Mitigate Cyber Security Incidents

4 source controls mapped|3 target controls covered

17%

Nevada Gaming Control Board Cybersecurity Requirements

4 source controls mapped|1 target controls covered

17%

India CERT-In Cyber Security Directions 2022

4 source controls mapped|2 target controls covered

17%

FTC GLBA Safeguards Rule (16 CFR Part 314)

4 source controls mapped|2 target controls covered

17%

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements

4 source controls mapped|2 target controls covered

17%

ASIS SPC.1-2009 - Organizational Resilience Standard

4 source controls mapped|4 target controls covered

17%

UK Open Banking Standard

4 source controls mapped|3 target controls covered

17%

ITIL 4

4 source controls mapped|2 target controls covered

17%

ISO 20000-1

4 source controls mapped|2 target controls covered

17%

ISO/IEC 23894:2023

3 source controls mapped|4 target controls covered

13%

SEC Climate Disclosure Rule

2 source controls mapped|1 target controls covered

PIC/S Guide to Good Manufacturing Practice for Medicinal Products

2 source controls mapped|1 target controls covered

Own Risk and Solvency Assessment (ORSA) - NAIC Model Act

2 source controls mapped|1 target controls covered

OECD Recommendation on Artificial Intelligence (2024 Update)

2 source controls mapped|1 target controls covered

OCC Heightened Standards (12 CFR Part 30, Appendix D)

2 source controls mapped|2 target controls covered

NIST SP 800-39

2 source controls mapped|2 target controls covered

NIST SP 800-37

2 source controls mapped|2 target controls covered

NIST SP 800-30

2 source controls mapped|3 target controls covered

New Zealand Information Security Manual (NZISM)

2 source controls mapped|1 target controls covered

Lloyd's of London Cyber Insurance Requirements and Underwriting Standards

2 source controls mapped|1 target controls covered

ICMM Mining Principles (2024 Update)

2 source controls mapped|1 target controls covered

ICH Q10 - Pharmaceutical Quality System

2 source controls mapped|1 target controls covered

ICH E6(R3) - Good Clinical Practice

2 source controls mapped|1 target controls covered

ICAO Annex 17 - Aviation Security (AVSEC)

2 source controls mapped|2 target controls covered

GLI-33 - Gaming Laboratories International Event Wagering Systems

2 source controls mapped|1 target controls covered

German Supply Chain Due Diligence Act (LkSG)

2 source controls mapped|1 target controls covered

AS9100D - Aerospace Quality Management System

2 source controls mapped|1 target controls covered

ISO/IEC 27557:2022 - Organisational Privacy Risk Management

2 source controls mapped|3 target controls covered

AML/CTF Act 2006 (Australia)

2 source controls mapped|1 target controls covered

IEC 60601-1 - Medical Electrical Equipment Safety

2 source controls mapped|3 target controls covered

Singapore AI Governance Framework

2 source controls mapped|1 target controls covered

FBI CJIS Security Policy

2 source controls mapped|1 target controls covered

Aged Care Quality Standards 2019 (repealed edition)

2 source controls mapped|1 target controls covered

Solvency II

2 source controls mapped|3 target controls covered

APRA SPS 220 Risk Management (Superannuation)

2 source controls mapped|1 target controls covered

Kuwait National Cybersecurity Framework

2 source controls mapped|1 target controls covered

ISO 31000

2 source controls mapped|3 target controls covered

IEC 62304:2015 Medical Device Software Lifecycle Processes

2 source controls mapped|3 target controls covered

ISO 27005

2 source controls mapped|3 target controls covered

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence

2 source controls mapped|1 target controls covered

ISO 37000:2021 - Governance of Organizations

2 source controls mapped|2 target controls covered

UAE Virtual Asset Regulatory Authority (VARA) Regulations

2 source controls mapped|1 target controls covered

IAIS Insurance Core Principles (ICPs)

2 source controls mapped|2 target controls covered

Authorised Economic Operator (AEO) Programmes - Global Standards

2 source controls mapped|1 target controls covered

ISO 20400:2017 - Sustainable Procurement

2 source controls mapped|1 target controls covered

ISO/IEC 27003:2017

2 source controls mapped|2 target controls covered

UK FCA/PRA Operational Resilience Framework

2 source controls mapped|1 target controls covered

South Africa Promotion of Access to Information Act (PAIA)

2 source controls mapped|1 target controls covered

NATO Cyber Defence Policy and NATO Computer Incident Response Capability (NCIRC)

2 source controls mapped|1 target controls covered

ITU-T X.805 - Security Architecture for End-to-End Communications

2 source controls mapped|1 target controls covered

ISO/IEC 27007:2020

2 source controls mapped|1 target controls covered

COBIT 2019

2 source controls mapped|1 target controls covered

IEC 62351 - Power Systems Communication Security

2 source controls mapped|2 target controls covered

ISO/IEC 27031:2011

2 source controls mapped|2 target controls covered

UK Security and Emergency Measures Direction (SEMD) - Water Industry

2 source controls mapped|2 target controls covered

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)

2 source controls mapped|1 target controls covered

ISO/IEC 25012:2008 - Data Quality Model

2 source controls mapped|1 target controls covered

Voluntary Principles on Security and Human Rights (VPs)

2 source controls mapped|1 target controls covered

Virginia CDPA

2 source controls mapped|1 target controls covered

Vietnam PDPD

2 source controls mapped|1 target controls covered

US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements

2 source controls mapped|2 target controls covered

Uruguay DPL

2 source controls mapped|1 target controls covered

UK Gambling Commission - Cyber Resilience Requirements

2 source controls mapped|1 target controls covered

UK GDPR (UK General Data Protection Regulation)

2 source controls mapped|1 target controls covered

Turkey KVKK

2 source controls mapped|1 target controls covered

Trinidad and Tobago Data Protection Act 2011

2 source controls mapped|1 target controls covered

TSA Pipeline Cybersecurity Directives

2 source controls mapped|1 target controls covered

Texas Data Privacy Act

2 source controls mapped|1 target controls covered

Tanzania Personal Data Protection Act (Draft)

2 source controls mapped|1 target controls covered

Taiwan PDPA

2 source controls mapped|1 target controls covered

Singapore Cybersecurity Act 2018

2 source controls mapped|1 target controls covered

Qatar DPL

2 source controls mapped|2 target controls covered

Privacy Act 2020

2 source controls mapped|1 target controls covered

POPIA

2 source controls mapped|1 target controls covered

Peru DPL

2 source controls mapped|2 target controls covered

Personal Data Act (personopplysningsloven)

2 source controls mapped|1 target controls covered

PDPA Thailand

2 source controls mapped|1 target controls covered

PDPA Singapore

2 source controls mapped|1 target controls covered

PAS 1192-5:2015 - Security-Minded Approach to BIM and Digital Built Environments

2 source controls mapped|1 target controls covered

Papua New Guinea National Cybersecurity Policy & Cybercrime Act (2016)

2 source controls mapped|1 target controls covered

Pakistan Personal Data Protection Bill 2023

2 source controls mapped|1 target controls covered

OWASP DevSecOps Maturity Model (DSOMM)

2 source controls mapped|1 target controls covered

Oregon Consumer Privacy Act

2 source controls mapped|1 target controls covered

Oman National Cybersecurity Framework

2 source controls mapped|1 target controls covered

NIST SP 800-146

2 source controls mapped|1 target controls covered

NIST SP 800-145

2 source controls mapped|1 target controls covered

NIST SP 800-144

2 source controls mapped|1 target controls covered

NIST SP 800-122

2 source controls mapped|1 target controls covered

Nigeria Open Banking Regulatory Framework (CBN, 2023)

2 source controls mapped|1 target controls covered

Nigeria Data Protection Regulation (NDPR)

2 source controls mapped|1 target controls covered

Nigeria Data Protection Act 2023 (NDPA)

2 source controls mapped|4 target controls covered

Nebraska Data Privacy Act

2 source controls mapped|4 target controls covered

New Jersey Data Privacy Act

2 source controls mapped|2 target controls covered

New Hampshire Data Privacy Act

2 source controls mapped|1 target controls covered

Montana Consumer Data Privacy Act

2 source controls mapped|1 target controls covered

Minnesota Consumer Data Privacy Act

2 source controls mapped|1 target controls covered

Mexico LFPDPPP

2 source controls mapped|1 target controls covered

Mauritius DPA

2 source controls mapped|1 target controls covered

Maryland Online Data Privacy Act of 2024

2 source controls mapped|2 target controls covered

Malaysia PDPA 2010

2 source controls mapped|2 target controls covered

Liechtenstein DPA

2 source controls mapped|1 target controls covered

LGPD

2 source controls mapped|1 target controls covered

Ley Orgánica de Protección de Datos Personales (LOPDP)

2 source controls mapped|1 target controls covered

Law No. 172-13 on the Protection of Personal Data

2 source controls mapped|1 target controls covered

Laos Law on Prevention and Combating Cybercrime (2015)

2 source controls mapped|1 target controls covered

South Korea PIPA

2 source controls mapped|2 target controls covered

Kentucky Consumer Data Protection Act

2 source controls mapped|2 target controls covered

Japan FSA Cybersecurity Guidelines for Financial Institutions

2 source controls mapped|1 target controls covered

Jamaica Data Protection Act 2020

2 source controls mapped|2 target controls covered

ISMAP (Japan)

2 source controls mapped|1 target controls covered

Iowa Consumer Data Protection Act

2 source controls mapped|2 target controls covered

Indonesia PDP Law

2 source controls mapped|2 target controls covered

Indiana Consumer Data Protection Act

2 source controls mapped|1 target controls covered

India DPDP Act

2 source controls mapped|1 target controls covered

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018)

2 source controls mapped|1 target controls covered

IAEA Nuclear Security Series - Computer Security at Nuclear Facilities (NSS-17-T Rev 1)

2 source controls mapped|1 target controls covered

IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems

2 source controls mapped|2 target controls covered

HITECH Act

2 source controls mapped|1 target controls covered

Ghana Cybersecurity Act

2 source controls mapped|3 target controls covered

FISMA

2 source controls mapped|2 target controls covered

FIRST CSIRT Services Framework and Standards

2 source controls mapped|1 target controls covered

Family Educational Rights and Privacy Act (FERPA)

2 source controls mapped|1 target controls covered

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)

2 source controls mapped|2 target controls covered

BSI IT-Grundschutz

2 source controls mapped|3 target controls covered

Canada ITSG-33 - IT Security Risk Management

2 source controls mapped|1 target controls covered

COSO Internal Control - Integrated Framework (2013)

2 source controls mapped|1 target controls covered

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)

2 source controls mapped|3 target controls covered

Bahrain PDPL

2 source controls mapped|2 target controls covered

ISO/IEC 30111:2019

2 source controls mapped|1 target controls covered

ISO/IEC 27010:2015

2 source controls mapped|1 target controls covered

Barbados Data Protection Act 2019

2 source controls mapped|1 target controls covered

NIST SP 800-171

2 source controls mapped|1 target controls covered

ISO/IEC 27400:2022

2 source controls mapped|1 target controls covered

Saudi Arabia PDPL

2 source controls mapped|2 target controls covered

AICPA Privacy Management Framework (PMF)

2 source controls mapped|1 target controls covered

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers

2 source controls mapped|2 target controls covered

SANS Incident Handler's Handbook and PICERL Methodology

2 source controls mapped|3 target controls covered

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity

2 source controls mapped|1 target controls covered

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices

2 source controls mapped|1 target controls covered

ISO 27018

2 source controls mapped|1 target controls covered

UK Telecommunications (Security) Act 2021

2 source controls mapped|1 target controls covered

ISO 27017

2 source controls mapped|1 target controls covered

NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

2 source controls mapped|1 target controls covered

NIST SP 800-190

2 source controls mapped|1 target controls covered

ISO 37001:2016

1 source controls mapped|1 target controls covered

SWIFT CSCF

1 source controls mapped|1 target controls covered

Australia Consumer Data Right - Banking (CDR)

1 source controls mapped|1 target controls covered

ISO 31000:2018

1 source controls mapped|1 target controls covered

Compare APRA CPS 234 with NIS2 Directive

What is APRA CPS 234 and who does it apply to?

APRA CPS 234 is a compliance framework from Australia with 10 domains and 24 controls. Australian Prudential Regulation Authority Information Security Standard It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does APRA CPS 234 actually require?

APRA CPS 234 has 24 controls organised across 10 domains. The largest domains are Testing Control Effectiveness (4 controls), Incident Management (3 controls), Internal Audit (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of APRA CPS 234 do I already cover?

APRA CPS 234 maps to 223 other compliance frameworks. The top mapping partners are NIS2 Directive (100% coverage), NIST SP 800-161 Rev 1 (100% coverage), FedRAMP High (100% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement APRA CPS 234?

Start your APRA CPS 234 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about APRA CPS 234 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 24 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required