au-apra-cps-234-expert

name	au-apra-cps-234-expert
title	APRA CPS 234 Expert
description	APRA CPS 234 expert for Australian prudential information security. Reference-depth framework plugin with scope determination, evidence checklist, and SCF-backed assessment guidance.
author	GRCEngClub
author_url	https://github.com/GRCEngClub/claude-grc-engineering/tree/main/plugins/frameworks/au-apra-cps-234/skills/au-apra-cps-234-expert
license	MIT
version	0.1.1
execution_mode	open
jurisdiction	au
practice	cybersecurity
language	en

APRA CPS 234 Expert

Reference-depth expertise for APRA Prudential Standard CPS 234 Information Security, represented in SCF as apac-aus-ps-cps-234-2019. This plugin bundles the SCF crosswalk (52 SCF controls to 38 framework controls) with CPS 234-specific assessment context.

Framework Identity

• SCF framework ID: apac-aus-ps-cps-234-2019
• Region: APAC
• Country: AU
• Regulator: Australian Prudential Regulation Authority (APRA)
• Common shorthand: APRA CPS 234
• Current assessment baseline: Prudential Standard CPS 234 Information Security, effective July 1, 2019

Framework In Plain Language

CPS 234 is APRA's prudential information security standard for regulated financial entities. It requires information security capability that is commensurate with threats, vulnerabilities, and the sensitivity and criticality of information assets. For GRC work, treat CPS 234 as an accountability and resilience framework: the assessor needs to see clear information-asset ownership, tested controls, incident response readiness, and board-level oversight of material information security risk.

Territorial Scope And Applicability

CPS 234 applies to APRA-regulated entities, including authorised deposit-taking institutions, general insurers, life insurers, private health insurers, RSE licensees, and other regulated groups within APRA's prudential perimeter. Scope analysis should identify information assets managed directly, by related parties, or by third parties, including cloud and outsourced services. Do not limit the scope to systems hosted in Australia; assets and service providers are in scope when they support APRA-regulated operations.

Mandatory Artifacts

Evidence usually centers on information security policy, asset classification and ownership records, control standards, control testing plans and results, incident response plans, board or senior management reporting, vulnerability and threat monitoring, third-party assurance, materiality criteria, and notification records. CPS 234 does not define a SOC-style report package, but APRA-regulated entities should be able to show that control design, operating effectiveness, and incident notification obligations are managed and tested.

Cadence And Timelines

Control testing frequency should be commensurate with vulnerabilities, threats, asset criticality, asset sensitivity, and previous test results. CPS 234 also requires timely notification to APRA for material information security incidents and for material control weaknesses that cannot be remediated quickly. Assessment output should preserve both the control-testing cadence rationale and the evidence that incidents and weaknesses were escalated under the entity's materiality criteria.