Frameworks · APRA CPS 230
Coming soonAPRA CPS 230 operational risk management readiness
APRA CPS 230 readiness is coming soon to TrustProof: it will take you through Prudential Standard CPS 230 Operational Risk Management, in force since 1 July 2025: operational risk and controls, incidents, critical operations and tolerance levels, business continuity testing and service providers. There is no CPS 230 certification: APRA supervises regulated entities, your Board approves your plans, and TrustProof will keep the evidence and drafts behind them.
Key facts
What you can check
- Critical operations and tolerance levels
- Items across operational risk, controls, incidents, critical operations, business continuity and service providers, in TrustProof's own words with paragraph numbers only.
- Regulated entity or service provider
- You will record whether you are an APRA-regulated entity (an SFI or not) or a service provider supporting one. That decides which items you can set aside.
- You deal with APRA
- You notify APRA and submit your material service provider register yourself. TrustProof keeps the procedure, the log and the working copy; it does not contact APRA for you.
- Read-only AWS role
- TrustProof connects through a read-only IAM role you create from our CloudFormation template and can remove at any time. No passwords, no stored keys.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Will walk you through each paragraph with plain-language questions
- Will keep your critical operations register, tolerance levels and material service provider register with review dates
- Will track business continuity testing, annual reviews and Board approvals
- Will collect AWS evidence through a read-only role
- Will give your auditor their own dashboard, with two-step verification
What TrustProof doesn't do
- TrustProof does not certify, and there is no CPS 230 certification.
- It does not notify APRA, submit your material service provider register or give legal or regulatory advice.
- TrustProof is not affiliated with or endorsed by APRA.
FAQ
Frequently asked questions
Does this apply to us?
CPS 230 applies to APRA-regulated entities: ADIs, general and life insurers, private health insurers and RSE licensees. Service providers they rely on can use TrustProof to give those customers the evidence they ask for.
Is it different for significant financial institutions?
The standard applies to every regulated entity. APRA gave non-SFIs an extra year for some business continuity requirements, which ended on 30 June 2026, and expects SFIs to have stronger practices.
Does TrustProof notify APRA for us?
No. You notify APRA of material incidents, disruptions beyond tolerance and material arrangements yourself. TrustProof keeps your notification procedure and a log of what you sent and when.
When will APRA CPS 230 readiness be available?
It is coming soon. The free read-only AWS scan and One-Button Fix are available today. Talk to us if you would like to hear when it opens; this page will be updated when it does.
What does it cost?
The first AWS scan is free. One-Button Fix is A$1,499 one-off. Plans are a one-off Readiness Programme plus Continuous Monitoring from A$899 a month. All prices are in Australian dollars and include GST.