CPS 230 requires APRA-regulated entities to manage operational resilience, so banks, insurers, and super funds are reviewing the technology suppliers that support their important operations.
Even if your IT business is not directly regulated by APRA, enterprise clients can still ask for service-specific evidence of how you withstand disruption, manage third-party risk, and escalate serious incidents.
Those requests often arrive as lengthy security questionnaires or stricter contract terms.
When you keep that evidence up to date, you can help the client complete its review faster while keeping procurement moving and strengthening your position at renewal or tender time.
Let’s have a look at it.
What Is CPS 230?
CPS 230 is APRA’s prudential standard for operational risk management. CPS 230 requires regulated entities to:
- Manage operational risks
- Keep critical operations running through severe disruption
- Manage the providers they rely on.
Cybersecurity supports this work, but CPS 230 also covers people, processes, systems, data, and external events.
To see what your client needs, look at what APRA protects and why it combined outsourcing and continuity.
This places CPS 230 within wider cybersecurity compliance without making cyber controls the whole answer.
What the Standard Sets Out to Achieve
CPS 230 aims to keep important financial services available when disruption hits, which is to keep those services running, each regulated entity must:
- identify operational risks, test controls, and fix weaknesses;
- maintain critical operations within approved tolerance levels through a tested business continuity plan; and
- assess, contract with, monitor, and exit material service-provider arrangements.
Thus, the regulated entity must know which operations matter, what supports them, and how much disruption it can tolerate.
Those duties reach your business when a client asks how the service runs, which controls protect it, and how you will recover if those controls fail.
Which Prudential Standards CPS 230 Replaces
CPS 230 replaced five standards that had separated outsourcing from business continuity:
- CPS 231 Outsourcing;
- SPS 231 Outsourcing;
- HPS 231 Outsourcing;
- CPS 232 Business Continuity Management; and
- SPS 232 Business Continuity Management.
By bringing outsourcing and continuity into one standard, CPS 230 now reaches beyond traditional outsourcing.
Let’s say, your client may treat your service as material because a critical operation relies on it or because the arrangement creates material operational risk.
Who CPS 230 Applies To
CPS 230 applies directly to APRA-regulated entities, while most IT suppliers see its effects in client contracts and assessments.
To see where you sit, check who buys your service, how heavily the client relies on it, and which other providers help you deliver it.
APRA-Regulated Entities in Scope
CPS 230 directly covers banks and other authorised deposit-taking institutions, general insurers, life companies, private health insurers, and registrable superannuation entity licensees.
They remain responsible even when a supplier performs the work.
Your client therefore needs enough access, evidence, and contract control to assess the risk rather than accept a vendor assurance at face value.
Material Service Providers and the Contractual Flow-Down
A material service provider supports a critical operation or exposes the regulated entity to material operational risk.
APRA also requires entities to treat providers of core technology services as material unless they can justify another conclusion.
Your client makes that decision against its use of your service. The same SaaS platform may be material to one client and non-material to another, because the operational impact differs.
So, once your client treats the arrangement as material, it will check you before signing, monitor delivery, and plan its exit.
The contract is likely to cover service levels, data control, audit access, subcontracting, incidents, liability, and exit.
Then, ask which service and operation the review covers, because a company-wide answer can miss the client’s concern.
Fourth-Party Providers
A fourth party is a provider that you rely on to serve the APRA-regulated client.
Your cloud host, identity platform, data centre, carrier, or monitoring supplier may sit in this layer.
Your client will want to know who supports the service and where the work and data sit.
It may also ask how you learn about an upstream outage and what happens if that provider fails.
Link each fourth party to the service it supports, because a supplier register alone does little to help.
The Core CPS 230 Requirements
The CPS 230 prudential standard tells regulated entities to test controls, set disruption tolerances, plan for continuity, manage material providers, and report certain events to APRA.
Because your service may support this work, your client can ask you to prove how you handle each part.
Operational Risk Management and Control Testing
Regulated entities must identify operational risks, test the controls that manage them, and fix weaknesses in a timely manner.
The testing frequency must reflect the risk, while material results must reach senior management.
Show your client who owns each control, when your team monitored or tested it, what failed, and when you fixed it.
We suggest using a vulnerability assessment to find and prioritise weaknesses. Pair the results with an owner, due date, fix, and retest so the client can see what changed.
Critical Operations and Tolerance Levels
Tolerance levels establish the maximum degree of disruption a critical operation can sustain before causing material harm to financial stability or retail customers.
Because critical operations are those essential services whose interruption threatens an entity’s viability, APRA explicitly identifies key core functions, such as:
- Payment systems and deposit handling for banks
- Claims management for insurers
- Fund administration for superannuation trustees.
To ensure these essential activities remain resilient during systemic shocks, every regulated entity must establish three core thresholds for each critical operation:
- The maximum tolerable period of disruption;
- The maximum acceptable data loss; and
- The minimum service level required throughout the outage.
Although standard service-level agreements often address routine performance, they may not automatically satisfy these rigorous standards.
This circumstance makes it vital to align tested recovery targets with client expectations so that regulatory reviews or contract discussions proceed smoothly.
Business Continuity Plans, Testing and Scenario Analysis
A CPS 230 business continuity plan must show how the entity will keep critical operations within tolerance during severe disruption.
To prove the plan works, the entity must test every critical operation through a set programme and run an exercise each year. Its scenarios must include material provider failure.
If your service supports the operation, test what could actually stop you delivering it.
For instance, a cloud outage, ransomware event, identity failure, or unavailable specialist team will show whether your people, systems, and communications work together.
Data backup is no different because it helps only when a restore test shows that the service, permissions, and integrations can return within the agreed limits.
Management of Service Provider Arrangements
Regulated entities must manage material arrangements from selection through monitoring and exit.
They also need a service-provider policy, legally binding agreements, and an annual register of material providers.
That duty reaches your contract because the client needs terms that cover:
- Service scope, performance levels, and reporting;
- Data ownership, audit access, and compliance duties;
- Subcontractors and the material providers you rely on;
- Continuity, substitution, and orderly exit; and
- APRA access to relevant information and the provider.
Check each promise against how your team works. If the contract sets a response time that your support path cannot meet, fix the process or renegotiate the term before an incident tests it.
Incident Notification to APRA
Regulated entities must notify APRA within four main periods, which often lead them to set shorter supplier deadlines:
- 72 hours: After becoming aware of an operational incident likely to have a material financial impact or materially affect critical operations;
- 24 hours: After a critical operation is disrupted outside its tolerance;
- 20 business days: After entering or materially changing an agreement for a service that supports a critical operation; and
- before offshoring: Before entering or significantly changing a material offshoring arrangement.
The APRA clock applies to your client, not an ordinary IT supplier.
Your contract may still require faster notice so the client can assess the event and report on time.
To that end, make sure your staff knows who contacts the client, what facts to provide, and who sends updates while technical work continues.
CPS 230 Effective Dates and Transition Arrangements
The key timeline for CPS 230 and its transition arrangements are:
- **1 July 2025: **CPS 230 first took effect. Its original transition rules applied the new requirements to a pre-existing service-provider contract at its next renewal or on 1 July 2026, whichever came first. APRA also gave non-significant financial institutions until 1 July 2026 for specified continuity and scenario-analysis requirements. Those transition periods have since ended.
- **1 July 2026: **A revised CPS 230 commenced, providing narrow contractual relief for listed non-traditional providers on standardised or non-negotiable terms. Ordinary IT and cloud providers are not among those listed categories, although APRA can grant written exemptions.
CPS 230 Compared With CPS 234, CPS 231, and CPS 232
To cut a long story short, the CPS 230 covers operational resilience, CPS 234 covers information security, CPS 231 covered outsourcing, while CPS 232 covered business continuity.
That difference changes the evidence your client will ask you to provide:
| Standard | Status and purpose | What you are likely to see |
|---|---|---|
| CPS 230 | In force. Covers operational risk, continuity, and material providers. | Recovery evidence, service levels, incident escalation, fourth-party disclosure, and exit terms. |
| CPS 234 | In force. Covers information-security capability and controls. | Control testing, vulnerability management, incident response, and assurance over customer assets. |
| CPS 231 | Superseded. Covered outsourcing of material business activities. | Its supplier duties now sit within the broader CPS 230 model. |
| CPS 232 | Superseded. Covered business continuity management. | Its continuity duties were updated and moved into CPS 230. |
As an illustration, if your client reports an information-security incident under CPS 234, APRA says it does not need to file a second incident report under CPS 230. It must still check whether the disruption crossed another CPS 230 threshold.
Keep the evidence purposes distinct. A penetration test can validate security controls, while a recovery exercise shows whether the service returns within the client’s operational tolerance.
What CPS 230 Means for Australian SMBs Supplying Regulated Entities
For an Australian IT supplier, CPS 230 turns resilience into a sales, renewal, and delivery issue.
Clients will test it through the questions they ask, the cyber evidence you provide, and the frameworks you use to organise your response.
What Banks and Insurers Now Ask of Their Service Providers
Banks and insurers now need evidence that your service can run, recover, and exit under their risk settings.
Because each client uses your service differently, its questionnaire will focus on different risks.
For that reason, cyber insurance will ask you to show:
- Service owners, delivery locations, and dependencies;
- Continuity plans, recovery tests, and unresolved actions;
- Service levels and actual performance;
- Incident records and customer-notification steps;
- Subcontractors, fourth parties, and offshore delivery;
- Security assessments and remediation evidence; and
- Substitution, data return, and exit arrangements.
Given those variables, keep one dated evidence pack and reuse it for each client’s service and contract.
This reduces repeated work and helps your sales team answer tender or renewal questions without waiting for several technical owners.
Where Cyber Security Controls Sit Inside a CPS 230 Response
Cybersecurity controls support CPS 230 when they prevent disruption, detect it early, contain it, or help your service recover.
The standard does not prescribe MFA, penetration testing, or a specific security product. Instead, show which operational risk each control reduces.
Monitoring and triage help you spot incidents and escalate them sooner. Vulnerability management gives each weakness an owner and tracks the fix.
Penetration testing checks selected attack paths, while protected backups help you restore the service within its limits. Access controls, MFA, patching, and endpoint protection reduce common routes to interruption.
Using Essential Eight and SMB1001 as Evidence of Resilience
Essential Eight and SMB1001 help you organise controls and evidence, but neither establishes CPS 230 compliance.
Thus, you should compare their different scopes against the evidence your client wants before choosing one as your base:
- The Essential Eight focuses on common attack paths through controls such as patching, MFA, restricted privileges, and backups.
- SMB1001 gives smaller organisations a tiered path across technology, policies, ownership, training, and recovery.
Whichever framework you use, show what your team does and link the evidence to the service your client is assessing. That link makes the framework useful in a tender or vendor review.
How to Get Ready for CPS 230 Scrutiny
APRA’s CPG 230 practice guide recommends a top-down approach for regulated entities preparing for CPS 230 scrutiny: Start by tracing the service from your client’s critical operation to the people, systems, suppliers, and controls that keep it running.
Once you have that map, you can gather the proof and fix anything that could hold up approval.
A Readiness Checklist for Smaller Service Providers
Demonstrating readiness for CPS 230 scrutiny relies on maintaining service-specific evidence that can be presented promptly when a customer assessment begins, as working through the following steps helps ensure all necessary documentation is organised beforehand:
- Confirm the scope: Ask which service, critical operation, entity, and contract the client is reviewing.
- Map dependencies. Record the people, systems, data, locations, subcontractors, and fourth parties needed to deliver it.
- Compare recovery figures: Test your recovery time, data-loss position, and minimum operating mode against the client’s requirements.
- Test escalation: Confirm who detects the event, contacts the client, and continues updates within the contractual window.
- Exercise continuity: Interrupt the actual service, record what happened, and assign every follow-up action.
- Maintain the baseline: Use an Essential Eight implementation plan where it fits, and keep configuration or assessment evidence.
- Validate exposed systems: Scope a penetration test around relevant systems, then retest material fixes.
- Track weaknesses: Record each owner, due date, risk decision, status, and verification result.
- Prioritise investment: Use a cybersecurity strategy to fund the controls that protect customer delivery.
- Index the evidence: Record each document, owner, scope, date, and review cycle so sales and delivery teams can find it quickly.
Common Gaps That Stall a Service Provider Assessment
Before the client review, check for these gaps that stall assessments when your documents cannot show how the promised service runs and recovers:
- A generic BCP that omits the service, dependencies, and recovery sequence;
- Recovery targets copied from a template but never tested;
- Successful backup logs without a completed restore;
- No link between fourth parties and the service they support;
- Supplier notice periods that leave the client too little time;
- Policies without logs, results, owners, or exception records;
- Recurring vulnerabilities without tracked fixes; and
- An old penetration test whose scope no longer matches production.
Fix the broken operating step instead of adding another policy. If recovery time is untested, run the exercise; if escalation is too slow, change the workflow.
Meet Your CPS 230 Obligations With Redscale
As you know, the vendor reviews stall when recovery tests cannot show whether the service will return on time, an upstream provider lacks an owner, or the incident record ends before a fix.
Your team chases the missing detail while a renewal, tender, or project approval misses its decision date.
The client needs to see who saw the alert, fixed the weakness, and retested it.
Redscale keeps records tied to the service.
Our structured managed security services team monitors systems and routes incidents to the right people.
While our vulnerability management service will help you track weaknesses through to a verified fix.
Furthermore, our OSCP- and CREST-certified testers deliver independent proof that satisfies rigors vendor reviews without unnecessary complexity.
Book a free discussion with a Redscale expert to review your client requirements and strengthen your position in upcoming tenders.
