Frameworks · Asia-Pacific
CPS 230 asks you to set tolerance levels for critical operations and manage material service providers. CPS 234 asks you to test controls, including at third parties. Aspian Cloud records both as work happens.
- Instrument
- APRA Prudential Standard CPS 230 Operational Risk Management; APRA Prudential Standard CPS 234 Information Security
- In force
- CPS 230 first commenced 1 July 2025. An amended CPS 230 (made 23 April 2026, finalised 30 April 2026) commenced 1 July 2026, adding limited contractual exemptions for specified non-traditional providers; the grace period for pre-existing contracts ended 1 July 2026. CPS 234 effective 1 July 2019
- For
- APRA-regulated banks, insurers and superannuation trustees, and their material service providers.
| Clause | What it requires | Evidenced by |
|---|---|---|
| CPS 230 'Critical operations and tolerance levels' | Identify critical operations and set board-approved tolerance levels for each, covering maximum disruption period, data loss and minimum service levels.Source: apra.gov.au | Critical operations and their tolerance levels on every approval card that touches them. |
| CPS 230 'Material service providers' and 'Service provider agreements' | Keep a register of material service providers and govern each material arrangement under a formal agreement with required terms, including subcontracting notice and APRA access.Source: apra.gov.au | The supplier register and engagement records, with contract clause templates for counsel. |
| CPS 234 paras 16, 21, 27 | Assess third parties' information security capability, implement controls across the asset lifecycle, and systematically test control effectiveness, including third-party-managed assets.Source: apra.gov.au | Repository baselines and policy results for supplier-managed code, with scorecards for the board. |
| CPS 234 paras 35-36 | Notify APRA within 72 hours of material information security incidents and within 10 business days of material control weaknesses that cannot be fixed promptly.Source: apra.gov.au | Incident records linked to changes, with the timeline your notifications draw on. |
Clause references and requirements were read on 8 November 2026 from the official text. Aspian Cloud evidences these clauses; it doesn’t make you compliant, and your assessor decides.
Want the mapping for a framework we don’t list? Ask us. A new framework is a data file, not a code change.
See what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.