APRA CPS 234 for technology suppliers: what your bank or insurer customer will ask

Regulated entity or supplier: the distinction that matters

CPS 234 applies to APRA-regulated entities. They must keep information security capability that matches the threats to their information assets, classify those assets, put controls in place, test them, and arrange internal audit review. The standard covers information assets that related parties or third parties manage on the entity’s behalf, and the entity stays responsible for them.

A supplier is not regulated by APRA under CPS 234 simply by selling to a regulated entity. Your obligations are the ones in your contract, plus whatever you tell the customer in your assessment answers. That is why two suppliers can face quite different requests: the customer decides how much assurance it needs from each, based on how critical your service is and what information it touches.

Two points often surprise suppliers. APRA supervises regulated entities and does not certify anyone, so there is no CPS 234 certificate to obtain. And a regulated entity has to notify APRA of material information security incidents within 72 hours and of material control weaknesses within 10 business days, which is why customers care about how quickly you tell them. Those limits are in paragraphs 35 and 36 of APRA CPS 234 Information Security.

What the questionnaire will cover

Formats differ, but supplier questionnaires from regulated entities commonly ask about:

• Governance: who is accountable for information security, and which policies are approved and reviewed.
• Asset inventory and classification: what customer information you hold, where, and how sensitive it is.
• Access control: multi-factor authentication, least privilege, joiner-mover-leaver handling and access reviews.
• Protection of data: encryption at rest and in transit, key management, backups, and where data is hosted.
• Logging and detection: what is recorded, how long it is kept and who watches it.
• Testing: vulnerability management, penetration testing and how findings are tracked to closure.
• Incident response: your plan, your notification commitments to the customer, and whether you have tested it.
• Subcontractors: which fourth parties handle customer information and how you oversee them.

Answers that point to dated records are stronger than assertions. A bank’s reviewer will usually prefer a screenshot or export with a date, a signed policy or a test report to a sentence that says “yes”.

Contract clauses to expect

Your customer’s legal team writes the contract, and the wording varies. Clauses that regulated entities commonly ask suppliers to accept include:

• Security obligations: maintaining controls appropriate to the information you handle, sometimes by reference to a standard or an assurance report.
• Incident notification: telling the customer within a stated period of becoming aware of an incident, so it can meet its own notification duties.
• Assurance and information rights: providing evidence on request, such as reports, test summaries or answers to follow-up questions, and sometimes allowing the customer or its auditor to review.
• Subcontracting: prior notice or consent before another party handles customer information.
• Data location, return and deletion: where data is hosted and what happens to it when the contract ends.
• Regulator access: cooperating when APRA asks the customer about the service.

Most of these supplier clauses (notification periods, APRA access, subcontracting) come from APRA CPS 230 Operational Risk Management, in force since 1 July 2025, and the regulated customer decides whether you are a material service provider. Have your own lawyer review these before you sign. A notification period you cannot meet is a common trap, so check it against your actual incident process first.

Evidence that answers the questions

Customers often accept an independent report in place of part of the questionnaire. A SOC 2 report from a licensed CPA firm or an ISO/IEC 27001 certificate from an accredited certification body can answer many of the questions at once, but neither shows by itself that your customer meets CPS 234, and the customer decides what it will accept. Our SOC 2 readiness guide covers the timeline for the first.

Whichever you hold, keep a small pack ready: approved policies, an incident response plan and notification procedure, your latest penetration test summary, a subcontractor list, and dated evidence of your cloud configuration. For AWS, the settings reviewers check first are covered in five AWS settings auditors check first. TrustProof’s free read-only scan collects that configuration evidence, and what the AWS scan checks lists every check.

How TrustProof asks “regulated entity or supplier?”

When you start CPS 234 readiness in TrustProof, you record whether you are an APRA-regulated entity or a supplier to one. A regulated entity keeps every paragraph in scope. A supplier may set aside the 8 paragraphs on third-party oversight, internal audit and APRA notification, each with a written justification, because those describe what only a regulated entity can do.

Only the workspace owner can change the answer, and every change is logged. If the new answer no longer allows an exclusion, that exclusion goes back to undecided and the scope needs a new sign-off. Suppliers also keep an assurance pack and notification commitments for their regulated customers. TrustProof does not notify APRA for anyone; your customer does that, and TrustProof does not certify, because there is no CPS 234 certification. See APRA CPS 234 readiness.

A practical order of work for a supplier

1. 1

   Ask the customer what it needs

   Ask which questionnaire, which reports it accepts, the notification period it expects and when it needs answers. This sets the scope.

2. 2

   Check your AWS configuration

   Run the free AWS scan and fix high-risk gaps through your normal change process before the questionnaire goes back.

3. 3

   Write down the procedures

   Approve the policies, incident response plan and customer notification procedure, and test the plan at least once so the answer is true.

4. 4

   Decide on independent assurance

   If several customers ask, a SOC 2 report or ISO/IEC 27001 certificate can answer the same questions once, instead of in a different format for each customer.

FAQ

Frequently asked questions