CPS 230 Explained: What APRA-Regulated Businesses Must Do Now

CPS 230 APRA compliance is no longer a future consideration. The Australian Prudential Regulation Authority's Prudential Standard CPS 230 Operational Risk Management took effect on 1 July 2025, and every APRA-regulated entity must demonstrate compliance now. The standard does not distinguish between entities that planned ahead and those that did not.

CPS 230 consolidates and replaces three earlier standards: CPS 231 (Outsourcing), CPS 232 (Business Continuity Management), and CPG 233 (Operational Risk). APRA designed it to address specific, documented failures seen across the sector: controls that existed on paper but had never been tested, BCPs that excluded third-party provider failures, and outsourcing arrangements where regulated entities had no meaningful visibility into their suppliers. CPS 230 closes all three gaps simultaneously.

What CPS 230 Actually Requires: The Five Core Obligations

1. 01

   Identify and Document Critical Operations

   An APRA-regulated entity must formally identify each process that, if disrupted beyond defined limits, would cause material adverse impact to depositors, policyholders, beneficiaries, or the financial system. The definition is deliberately broad and includes processes operated by a service provider on the entity's behalf. Outsourced IT infrastructure, cloud platforms, and managed security services all potentially fall within scope.
2. 02

   Set Board-Approved Tolerance Levels

   For every critical operation, the entity must define a Recovery Time Objective (maximum acceptable downtime) and a Recovery Point Objective (maximum acceptable data loss). These are not technical parameters set by the IT team. They require board approval. Any IT provider supporting a critical operation must then align their delivery and recovery capabilities to those board-approved tolerances.
3. 03

   Maintain and Annually Test a Business Continuity Plan

   CPS 230 requires a credible, tested BCP. The testing programme must run at least annually and include scenario exercises covering cyber-attacks, system outages, and service provider failures. If your BCP has never been tested with your IT or security provider simulating a failure scenario, it does not satisfy the standard. APRA will specifically look for evidence of third-party BCP participation in supervisory reviews.
4. 04

   Identify, Register, and Govern Material Service Providers

   A service provider is "material" if the entity relies on it for a critical operation, or if the arrangement poses material operational risk. Entities must maintain a comprehensive register of all material service providers. The initial register was due to APRA by 1 October 2025. Critically, the standard extends oversight to fourth parties: the vendors your MSPs rely on. Existing contracts must be uplifted by the earlier of the next renewal date or 1 July 2026.
5. 05

   Report Significant Operational Incidents to APRA Within 72 Hours

   When a material operational disruption occurs, including a cyber incident, the entity must notify APRA promptly. APRA's guidance references a 72-hour operational planning window. The notification must cover the nature of the disruption, actions taken, likely business impact, and the expected timeline to normal operations. This requirement integrates with the Cyber Security Act 2024's mandatory ransomware reporting obligations.

5 Signs Your IT Provider Is Not Taking CPS 230 Seriously

Most mid-market managed services providers were built around infrastructure uptime and helpdesk response times. CPS 230 demands something fundamentally different: documented, tested operational resilience that can withstand APRA supervisory scrutiny. These are the five signs your current IT provider does not meet that standard.

Sign 1: They Cannot Produce a Written BCP Covering Your IT Systems

Ask your IT provider for their business continuity plan as it relates to services they deliver to your organisation. A CPS 230-ready provider will have a documented plan, a testing schedule, and results from the most recent exercise. If the response is vague, such as "we have redundancy" or "we follow best practices," that describes infrastructure, not a BCP. CPS 230 requires your IT provider to actively participate in BCP testing, not simply acknowledge that your plan exists.

Sign 2: Their Contracts Do Not Include APRA Audit Access Rights

Contracts with material service providers must include a clause granting your auditors and APRA the right to access the provider's information and premises. This is not optional. Most IT services agreements written before 2023 do not include this clause. Ask your provider directly whether your contract grants APRA the right to audit their operations. The answer tells you how seriously they have engaged with the standard.

Sign 3: They Cannot Specify RTOs for Your Critical Systems

If your IT provider cannot tell you in writing what their committed Recovery Time Objective is for each of your critical systems, they cannot demonstrate alignment to your board's tolerance levels. Monthly uptime of 99.9% is compatible with a single outage exceeding seven hours. If your board-approved tolerance for a core banking or claims processing system is two hours, that SLA is structurally insufficient and does not satisfy CPS 230.

Sign 4: They Have No Visibility Into Their Own Subcontractors

CPS 230 requires entities to understand the extended supply chain of their MSPs, including fourth parties. When we ask IT providers to document their subcontracting arrangements, the typical response reveals no one has mapped this chain. The SOC may be run by a third party. The backup platform may be hosted offshore. If your MSP cannot provide a documented view of their supply chain and those parties' obligations, your entity cannot satisfy its fourth-party oversight requirement.

Sign 5: Cyber Incidents Reach You Days Later Rather Than Within Hours

The 72-hour notification clock starts when the incident is detected, not when your IT provider gets around to telling you. If incident communication relies on a standard helpdesk P1 queue, you do not have the escalation architecture CPS 230 requires. Material incidents need a direct path from your IT provider to your designated accountable executive, with pre-agreed communication templates containing the specific information APRA's notification forms require.

CPS 230 Compliance Checklist

The following checklist covers the minimum actions required to demonstrate meaningful progress to APRA's supervisory team. Most organisations find material gaps in at least three of these areas on first review.

• ✓
  Critical operations identified, documented, and reviewed by the board
• ✓
  Tolerance levels (RTO and RPO) defined and board-approved for each critical operation
• ✓
  Business continuity plan updated to include service provider failure scenarios and tested within the past 12 months
• ✓
  Material service provider register completed and submitted to APRA
• ✓
  All MSP contracts reviewed against mandatory CPS 230 clauses: APRA audit access, RTO alignment, subcontracting rules, exit provisions
• ✓
  Pre-existing MSP contracts uplifted or renegotiation underway ahead of the July 2026 deadline
• ✓
  Single accountable executive assigned to each material service provider relationship
• ✓
  Incident escalation paths and APRA notification templates documented and tested