Frameworks · APRA CPS 234
APRA CPS 234 readiness for regulated entities and their suppliers
APRA CPS 234 readiness in TrustProof takes you through paragraphs 13 to 36 of the information security standard, whether you are an APRA-regulated entity or a supplier giving one assurance. You record which you are when you start: a regulated entity keeps every paragraph in scope, and a supplier can set aside the paragraphs only a regulated entity can meet, with a written justification.
Key facts
What you can check
- Requirement library
- 24 paragraphs (13 to 36) plus a supplier assurance item, in TrustProof's own words with paragraph numbers only.
- Regulated entity or supplier
- Asked when the programme starts. Only the workspace owner can change the answer, and every change is logged. A supplier may set aside the 8 paragraphs on third-party oversight, internal audit and APRA notification; a regulated entity cannot.
- APRA notification times
- Procedures and timestamped logs for the 72-hour incident notification and the 10-business-day control weakness notification. TrustProof does not notify APRA for you.
- AWS evidence
- 4 paragraphs (asset identification, controls and incident detection) can draw on evidence from TrustProof's read-only AWS checks.
- SHA-256 sign-offs
- Each owner sign-off pins a SHA-256 fingerprint of exactly what was approved. If the document or decision changes, the sign-off stops counting until it is approved again.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Walks you through each CPS 234 paragraph with plain-language questions
- Records whether you are a regulated entity or a supplier, and which paragraphs you may set aside
- Keeps a supplier assurance pack and notification commitments for your regulated customers
- Records Board and senior management approvals as owner sign-offs
- Gives your internal auditor or assessor their own dashboard, with two-step verification
What TrustProof doesn't do
- TrustProof does not certify, and there is no CPS 234 certification. APRA supervises regulated entities and does not certify anyone.
- It does not notify APRA for you and is not legal or regulatory advice.
- TrustProof is not affiliated with or endorsed by APRA.
FAQ
Frequently asked questions
Is there a CPS 234 certification?
No. APRA supervises regulated entities and does not certify anyone. Testing and internal audit come from skilled, independent people; TrustProof organises the evidence they review.
We supply APRA-regulated customers but are not regulated ourselves. Is this for us?
Yes. Choose "Supplier to an APRA-regulated entity" when you start. You can set aside the paragraphs only a regulated entity can meet, with a justification, and keep an assurance pack for your customers.
Who can change whether we are a regulated entity or a supplier?
Only the workspace owner. Each change is logged, any exclusion the new answer does not allow goes back to undecided, and the scope needs a new sign-off.
Does TrustProof notify APRA for us?
No. Your organisation notifies APRA. TrustProof helps you keep the procedure and a log of when you became aware and when you notified.
What does it cost?
The first AWS scan is free. One-Button Fix is A$1,499 one-off. Plans are a one-off Readiness Programme plus Continuous Monitoring from A$899 a month. All prices are in Australian dollars and include GST.