Book a demo

CPS 234 information security made measurable

Map APRA CPS 234 capability requirements, centralise evidence, and give boards and risk committees a clear view of information security posture.

From policy binders to defensible capability

CPS 234 requires APRA-regulated entities to maintain information security capability commensurate with the size and extent of threats to their information assets - not just documented policies.

Boards must understand whether controls are designed and operating effectively. Spreadsheets and scattered artefacts make that hard to prove under time pressure.

Constant structures CPS 234 domains, assigns owners, collects evidence, and tracks remediation so assurance conversations focus on outcomes rather than file hunting.

Board-ready assurance views

Risk committees need a consistent story: what capability exists, where gaps remain, and what remediation is underway. Constant turns control status and evidence into reporting your board can act on - without implying APRA certification.

Built for APRA-regulated organisations

  • Banks, insurers, and superannuation trustees subject to CPS 234
  • Risk and compliance teams preparing for APRA engagement or internal assurance
  • CISOs and security leaders reporting information security capability to the board
  • MSPs supporting regulated financial services clients

CPS 234 capability domains

The capability areas Constant organises around CPS 234, and how teams typically evidence and assure each one.

Information security policy frameworkRoles, responsibilities, and policy structures that govern information security.

Document how information security is governed: roles, policy hierarchy, and accountability. Constant tracks whether policies are current, owned, and linked to the controls they enable - so assurance reviews start from a complete picture rather than a shared drive.

Information asset identificationClassification and ownership of assets commensurate with criticality.

Entities need to know which information assets matter and who owns them. Assessments capture asset scope, classification, and control coverage so capability claims stay tied to what is actually protected.

Implementation of controlsAccess, change, and operational controls that protect information assets.

Map technical and process controls to CPS 234 expectations. Evidence collection shows whether controls are implemented in production (not only described in policy) with remediation workflows when gaps appear.

Testing and assuranceRegular testing of control effectiveness and independent assurance.

Schedule and record control testing, penetration testing outcomes, and independent reviews. Findings become tracked work items so testing drives improvement instead of becoming a one-off report.

Incident managementDetection, response, and notification aligned with CPS 234 expectations.

Maintain incident playbooks, detection evidence, and notification workflows. Constant helps you show that incident capability is defined, tested, and owned before an event forces the issue.

Internal auditOngoing review of capability and remediation tracking.

Internal audit findings feed the same remediation backlog as day-to-day assessments. Boards see whether issues are closed, overdue, or accepted with rationale.

What you get with Constant

Capability mapping

Structure assessments around CPS 234 information security capability domains with clear control guidance.

Evidence at control level

Link policies, test results, and operational artefacts to the controls that demonstrate capability.

Assessor-led validation

Certified assessors review critical controls so gaps are identified before APRA or internal audit.

Committee reporting

Summarise open gaps, owners, and remediation progress for risk committees and board packs.

Related frameworks and guidance

See how CPS 234 Information Security connects to related compliance and risk workflows in Constant.

Risk Matrix

Connect CPS 234 control gaps to owned risk treatments and residual risk reporting.

ISO 27001 readiness

Coordinate ISMS evidence and assurance work that may support both programs.

CPS 234 Information Security FAQs

Does Constant certify CPS 234 compliance?

No. Constant is a compliance management platform that helps you organise evidence, track capability, and prepare for assurance. APRA assesses regulated entities directly; Constant supports your internal program and assessor-led reviews.

Who needs to comply with CPS 234?

CPS 234 applies to APRA-regulated entities including authorised deposit-taking institutions, general insurers, life insurers, and registrable superannuation entity licensees. Your obligations depend on your APRA prudential framework.

How does Constant support CPS 234 board reporting?

Dashboards and exports summarise control status, open gaps, and remediation progress so risk committees and boards receive a consistent view of information security capability.

Can we run CPS 234 alongside other frameworks?

Yes. Many customers use Constant for CPS 234 alongside Essential Eight, ISO 27001 readiness, or internal risk programs within the same tenant structure.

Start your compliance journey today

Choose the right plan for your organisation. Scale seamlessly as your compliance needs evolve.

Ready to simplify your compliance process?

Book a demo and see constant in action.

Book a Demo Explore More

All Paid Plans Include

  • Unlimited human assessor reviews

  • Evidence collection

  • AI-assisted pre-reviews

  • Compliance dashboards

  • Australian business-hours support

  • On-demand reporting

  • Control owners and tasks

  • Evidence uploads

  • Maturity and gap tracking

  • Role-based access controls

  • Framework guidance

  • 5×5 Risk Matrix

  • Australian data residency