CPS 230 is APRA’s operational risk standard. It makes regulated banks, insurers and super funds name their material service providers, keep a register of them and send that register to APRA every year. CPS 234, in force since 2019, adds the security side: you must assess the security capability of any third party that manages your information assets.
The two standards meet at the service provider. Below we set their clauses side by side, list the deadlines APRA holds you to and give a working register template. Every row cites the paragraph it comes from, so your team can check it against the standard.
Who Has to Follow CPS 230 and CPS 234?
Both standards apply to every APRA-regulated entity. That covers authorised deposit-taking institutions (ADIs), general insurers, life companies, private health insurers and RSE licensees in superannuation. For foreign ADIs and a few foreign insurers, only the Australian branch is in scope (CPS 230 para 3).
CPS 230 first applied on 1 July 2025. Contracts already in place had until their next renewal, or 1 July 2026 at the latest. On 1 July 2026 an updated version of the standard took over. It drops the transition rule, moves defined terms into CPS 001 and adds relief for some provider types (para 57).
The paragraph numbers in this post follow that current version. Many summaries still quote the 2023 text, so their numbers are usually one off. The question is no longer how to prepare. It is which evidence you can show today.
What Makes a Service Provider Material?
The test is reliance. If a disruption at the provider would stop a critical operation, or would expose you to material operational risk, the provider is material.
APRA also sets a default list in para 49. Unless you can justify otherwise, these services count as material:
- Every entity: risk management, core technology services and internal audit.
- ADIs: credit assessment, funding and liquidity management, and mortgage brokerage.
- Insurers: underwriting, claims management, insurance brokerage and reinsurance.
- RSE licensees: fund administration, custody, investment management, and arrangements with promoters and financial planners.
If you decide one of these is not material for you, APRA’s guidance asks you to write down why. An accountable person approves the reasons, and you review them at least once a year (CPG 230 para 49). The note stays with you unless APRA asks for it.
Fourth parties count too. A fourth party is a party your provider relies on to deliver its service to you (CPS 230 footnote 14). Your policy must cover the fourth parties behind critical operations (para 47(c)). Contracts must also oblige the provider to tell you when it relies on other material providers (para 53(d)).
The 2026 version adds an exemption for listed provider types such as government agencies, regulators, central banks, exchanges and payment system operators. Where their terms are standard or there is no formal agreement, some contract and monitoring rules do not apply (para 57). Other arrangements can only be exempted by APRA in writing (para 58). CPG 230 calls these non-traditional service providers and asks you to use the relief only for the paragraphs you cannot meet (CPG 230 para 60).
How CPS 230 and CPS 234 Split the Work
CPS 230 tells you to meet CPS 234 when you manage technology risk (CPS 230 para 24). In practice, CPS 230 runs the provider relationship and CPS 234 runs the security checks inside it.
| Question | CPS 230 | CPS 234 |
|---|---|---|
| First applied | 1 July 2025 | 1 July 2019 |
| Main subject | Operational risk, critical operations and service providers | Security of information assets |
| Which providers | Material service providers, listed in a register | Any related or third party that manages your information assets |
| Before you sign | Due diligence and a risk assessment, para 52 | Assess the party’s security capability, para 16 |
| After you sign | Monitor service levels, controls and compliance, para 59 | Evaluate the design of the party’s controls, para 22 |
| Incident notice | 72 hours for a material operational risk incident, para 32 | 72 hours for a material security incident, para 35 |
Two details are easy to miss. CPS 234 para 16 covers all information assets managed by third parties, not only material outsourcing (footnote 7). And a security incident you already reported under CPS 234 needs no second notice under CPS 230 (CPS 230 footnote 11).
Which Clause Asks for Which Evidence?
An assessor will ask to see records, not intentions. The diagram shows the stages of one material provider’s life that the standards touch.
- Before signingDue diligence and a security capability check (CPS 230 para 52, CPS 234 para 16)
- ContractMinimum terms and APRA access (CPS 230 paras 53 and 54)
- Fourth partiesListed behind each critical operation (CPS 230 para 47(c))
- MonitoringService levels, controls and compliance (CPS 230 para 59)
- ExitOrderly exit and continuity tests (CPS 230 paras 43 and 55)
The table maps each duty to the record a team usually keeps for it. Paragraph numbers are from CPS 230, CPS 234 and the CPG 230 guide. Note that CPG 230 uses its own paragraph numbers.
| Clause | What it asks | Evidence to keep |
|---|---|---|
| CPS 230 paras 21(c), 46, 47 | A service provider management policy, approved by the Board. | The approved policy with its version and approval date. |
| CPS 230 paras 48, 49; CPG 230 para 49 | A register of material service providers, with the default list applied. | The register, plus approved reasons for any default service you did not class as material. |
| CPS 230 para 50 | Send the register to APRA every year. | A copy of each submission and the date it was sent. |
| CPS 230 paras 33(a), 34, 37 | A register of critical operations, each with tolerance levels. | Critical operations mapped to providers, with maximum outage, data loss and minimum service levels. |
| CPS 230 para 52; CPS 234 para 16 | Due diligence and a security capability check before a material arrangement. | Dated due diligence and security assessments from before the contract was signed. |
| CPS 230 paras 53, 54 | A binding agreement with minimum terms, including audit access and APRA access. | The signed contract and a clause checklist per material provider. |
| CPS 230 para 59; CPS 234 paras 22, 28 | Regular checks of service levels, control effectiveness and the provider’s own testing. | Periodic review records, reports to senior management and your view of the provider’s test reports. |
| CPS 230 paras 42, 43, 55 | Yearly continuity exercises that include provider outages, and a way to exit. | Exercise reports and an exit plan for each material provider. |
| CPS 230 para 61; CPS 234 para 34 | Internal audit reviews critical outsourcing and any third party assurance you rely on. | Internal audit reports to the Board or audit committee. |
The Deadlines APRA Holds You To
Seven deadlines run across the two standards. Teams often track the CPS 234 ones and forget the CPS 230 ones, so keep them in one list.
- 24 hours: a disruption to a critical operation outside its tolerance (CPS 230 para 41).
- 72 hours: an operational risk incident likely to have a material financial impact or to hit critical operations (CPS 230 para 32).
- 72 hours: an information security incident that materially affected, or could have affected, you or your customers (CPS 234 para 35).
- 10 business days: a material security control weakness you do not expect to fix in time (CPS 234 para 36).
- 20 business days: after you enter or materially change an agreement for a service that a critical operation relies on (CPS 230 para 60(a)).
- Before you sign: any material offshoring arrangement, including one where data or staff will sit outside Australia (CPS 230 para 60(b)).
- Every year: the register of material service providers (CPS 230 para 50).
The standard says “annual” for the register but names no form or due date. Check APRA’s current reporting instructions for the format, not a summary.
A Service Provider Register Template You Can Copy
APRA does not publish a layout for the register in the standard. The columns below come from CPS 230, CPG 230 and CPS 234. Four are our own suggestions and are marked as such.
| Column | Where it comes from |
|---|---|
| Provider legal name and relationship type (third party, related party or connected entity) | CPS 230 para 48 and footnote 15 |
| Service provided and the arrangements it covers | CPS 230 para 48 |
| Responsible person inside your organisation | CPG 230 para 48(a) |
| Critical operations supported, or the material risk it is linked to | CPG 230 para 48(b) |
| Why it is material: a para 49 default category or your own assessment | CPS 230 paras 48, 49, 51 |
| Default category not classed as material: reason, approver, last review | CPG 230 para 49 |
| Exempt provider type under para 57, and which paragraphs the relief covers | CPS 230 para 57; CPG 230 paras 57 to 60 |
| Fourth parties involved in the critical operation | CPS 230 paras 47(c), 53(d); CPG 230 para 48(c) |
| Agreement date and next renewal date | Our suggestion (the agreement itself: CPS 230 para 53) |
| Offshore service, data or staff, and the date APRA was told | CPS 230 para 60(b) |
| Date APRA was told about a new or changed agreement | CPS 230 para 60(a) |
| Information assets the provider manages, with their criticality and sensitivity | CPS 234 paras 16, 20 |
| Last security capability assessment and its result | CPS 234 para 16; CPG 230 para 53 |
| Last periodic review and next one due | CPS 230 para 59; CPG 230 para 53 |
| Exit or substitution plan in place | CPS 230 paras 47(a), 55(d) |
| Last continuity exercise that included this provider | CPS 230 para 43 |
| Risk rating | Our suggestion |
| Concentration flag: the same provider or fourth party behind several critical operations | Our suggestion (concentration is named in CPS 230 para 52(b)) |
| External exposure signals and the date last checked | Our suggestion (supports CPS 230 para 59(b)) |
If you already collect answers through a vendor questionnaire, our third-party cyber risk questionnaire template fills several of these columns at onboarding.
Where Questionnaires Stop and Outside-In Checks Start
Many vendor reviews rest on questionnaires, contract clauses and certificates. Those show a provider’s position on the day it answered. Yet CPS 230 para 59(b) asks for a regular assessment of control effectiveness. CPG 230 para 53 also lists security capability and service disruptions as topics for periodic reviews.
Part of that evidence can be gathered from outside, without asking the provider anything. Examples are internet-facing servers running versions with known vulnerabilities, expired certificates, exposed admin panels and staff credentials that appear in leaks. Our guide to vendor risk assessment from the outside in walks through these checks one by one.
These signals do not replace the provider’s own testing, or your CPS 234 para 28 view of it. They give you a dated finding to raise at the next review, and a reason to call earlier when something changes. External attack surface management runs such checks on your own assets, and the third-party risk management module applies them to the providers in your register. For the wider picture, see how teams handle supply chain and vendor risk.