CPS 230 vs CPS 234: Reconciling Operational Risk and Information Security Controls

CPS 234 has governed information security since 2019; CPS 230 takes full effect on 1 July 2026. Treat them as two regimes and you will build two registers, two testing regimes and two incident processes that disagree with each other in front of a supervisor.

The instinct inside most APRA-regulated entities is to hand CPS 234 to the CISO and CPS 230 to a resilience or operational-risk function, and let each run its own programme. That is how you end up with a material service provider register that does not reconcile with your list of third parties handling information assets, a scenario-testing library that never touches your security control tests, and two incident logs that classify the same outage differently. The standards overlap deliberately. The efficient answer is one control environment feeding both, with a crosswalk that says exactly which control satisfies which obligation.

What each standard is actually for

CPS 234 is narrow and deep. It is about the confidentiality, integrity and availability of information assets: defined roles, an information security capability sized to the threat, a control framework, systematic testing of those controls, internal audit review, and notification to APRA of material incidents within 72 hours and material control weaknesses within 10 business days. It reaches third parties only through the lens of information assets they manage on your behalf.

CPS 230 is broad and outcome-driven. It is about the ability to keep delivering critical operations through severe disruption: an operational risk management framework, business continuity within defined tolerance levels, a service provider management policy backed by a register of material service providers, and incident management with notification to APRA within 72 hours of an incident that materially affects, or is likely to materially affect, the entity or its critical operations. Security is one source of disruption among many — it sits inside CPS 230, not beside it.

So the relationship is not two peers. A cyber incident that takes down a critical operation is simultaneously a CPS 234 information security incident and a CPS 230 operational risk incident. A cloud provider hosting a core banking platform is both a third party managing information assets under CPS 234 and, almost certainly, a material service provider under CPS 230. The same event, the same supplier, two lenses. The question is whether your controls know that.

Where they overlap — and where each goes further

Three areas carry most of the shared load, and each has a seam where one standard extends past the other.

Third parties. CPS 234 requires you to evaluate the information security controls of parties managing your information assets. CPS 230 requires a material service provider register, formal agreements and ongoing monitoring for anyone delivering a critical operation or posing material operational risk. The overlap is the supplier assessment. CPS 230 goes further by pulling in providers that never touch data — a physical logistics or facilities dependency can be a material service provider without being a CPS 234 concern at all. Build one supplier inventory, tag each entry for both regimes, and let the register be a view over it rather than a separate artefact.

Incidents. Both standards impose a 72-hour clock to APRA, but the triggers differ: CPS 234 fires on a material information security incident, CPS 230 on an incident that materially affects critical operations or has material financial impact. A single incident taxonomy, classified once and routed to whichever notification obligations it meets, is far safer than two teams reaching two conclusions. CPS 234 adds the 10-business-day control-weakness notification, which has no CPS 230 twin — keep it, but hang it off the same register of control deficiencies.

Testing. CPS 234 wants systematic testing of security controls at a frequency matched to risk. CPS 230 wants business continuity and scenario testing against severe-but-plausible disruption, proving you can hold critical operations within tolerance. These are not the same test, but they should share a calendar and a plausible-scenario library. A ransomware scenario is the obvious case where a CPS 234 control test and a CPS 230 disruption test are two halves of one exercise, and running them apart wastes the most expensive part — the scenario design.

The crosswalk is the artefact

The document that makes this real is a crosswalk: one row per shared control, columns showing which CPS 230 and CPS 234 obligations it satisfies, who owns it, and where the evidence lives. It is what lets you answer a supervisor asking “show me how you manage third-party security” and “show me your material service provider controls” from the same source of truth, without the two answers contradicting each other.

# cps230-cps234-crosswalk.csv
# One control, mapped to both standards. Owner and evidence are the load-bearing columns.
# CPS 230 references are paragraph-level; verify against the July 2025 determination in force from 1 July 2026.
control_id,control,cps230_obligation,cps234_obligation,owner,evidence
CTL-01,Supplier inventory & classification,Material service provider register,Third-party info-asset evaluation,Procurement,GRC register export
CTL-02,Third-party security due diligence,Service provider risk assessment,Evaluate third-party controls,Security,Assessment reports
CTL-03,Incident taxonomy & classification,72h critical-operations notification,72h material-incident notification,Ops Risk,Incident log + APRA lodgements
CTL-04,Control-deficiency register,Operational risk issue tracking,10-day control-weakness notification,Security,Deficiency tracker
CTL-05,Scenario & control testing calendar,BCP / severe-but-plausible testing,Systematic security control testing,Resilience,Test plans + results
CTL-06,Independent assurance,Operational risk review,Internal audit of infosec controls,Internal Audit,Audit reports
CTL-07,Board reporting pack,Operational risk profile reporting,Board infosec roles & oversight,Company Sec,Board minutes

The value is not the file format. It is that every shared control has a single owner and a single evidence trail, and that the mapping is explicit rather than assumed. When a control changes, you can see immediately which obligations move with it.

What to do before 1 July 2026

The sequencing matters, because CPS 234 is already live and the temptation is to bolt CPS 230 on top rather than reconcile the two. Start from what exists: your CPS 234 control set and supplier assessments are the foundation, not a parallel track. Then extend the supplier inventory to the non-security dependencies CPS 230 catches, define your critical operations and tolerance levels, and only then draw the crosswalk connecting the two. The pattern is the same one Canadian entities face reconciling OSFI B-13 and E-21 as a single programme rather than two: a technology-risk standard and a resilience standard that share most of their evidence and disagree only at the edges.

None of this is exotic engineering. It is a data-model decision about whether your suppliers, incidents, controls and tests live once or twice. CPS 230 is, as we have argued before, a proof standard wearing a policy standard’s clothes — and the proof is far cheaper to assemble when it is not being duplicated against the standard you already comply with.

Two registers that disagree is not two-thirds of the work done. It is a finding waiting for the first supervisor who asks the same question two ways.