For APRA-regulated entities including banks, insurers, and superannuation funds

Our APRA CPS 234 Compliance and Assurance Service is designed to support APRA- regulated entities in establishing, maintaining, and demonstrating information security capabilities that are commensurate with their risk profile and subject to effective governance and Board oversight, in line with APRA CPS 234-Information Security.

We provide independent, audit-led assessments that help organisations clearly understand their information security posture, identify material gaps, and demonstrate defensible compliance to Boards, senior management, internal audit, and regulators. Our approach focuses on assurance, not technology sales, ensuring independence and credibility.

We assess information assets, security controls, and operating environments against CPS 234 requirements, with a strong emphasis on control design, operating effectiveness, risk ownership, and accountability. This includes review of governance structures, policies, risk management practices, control testing, incident response capability, and regulatory notification processes. Our methodology aligns closely with APRA's expectations for Board accountability, management oversight, risk-based decision-making, and timely escalation of material security incidents.

We help organisations provide clear, evidence-based assurance that information security risks are identified, managed, tested, and reported in a consistent and timely manner. As part of the engagement, we conduct a current-state assessment aligned to Essential Eight maturity levels and CPS 234 obligations, followed by a prioritised, risk-based implementation roadmap. Where required, we provide advisory support to uplift mitigation strategies, strengthen control effectiveness, and improve security governance.

We also support user education and awareness programs, including phishing resilience and targeted training, to address human-related risks. Ongoing quarterly maturity assessments can be performed to track progress, validate remediation, and provide continuous assurance.

All CPS 234 activities are aligned with ISO/IEC 27001 to support integration into an existing or developing Information Security Management System (ISMS). The key deliverable is a measurable Essential Eight maturity uplift, supported by a clear audit trail, practical remediation guidance, and Board-ready assurance reporting capable of withstanding APRA supervisory and audit scrutiny.