CPS 234 Information Security

Q: Does Constant certify CPS 234 compliance?

No. Constant is a compliance management platform that helps you organise evidence, track capability, and prepare for assurance. APRA assesses regulated entities directly; Constant supports your internal program and assessor-led reviews.

Q: Who needs to comply with CPS 234?

CPS 234 applies to APRA-regulated entities including authorised deposit-taking institutions, general insurers, life insurers, and registrable superannuation entity licensees. Your obligations depend on your APRA prudential framework.

Q: How does Constant support CPS 234 board reporting?

Dashboards and exports summarise control status, open gaps, and remediation progress so risk committees and boards receive a consistent view of information security capability.

Q: Can we run CPS 234 alongside other frameworks?

Yes. Many customers use Constant for CPS 234 alongside Essential Eight, ISO 27001 readiness, or internal risk programs within the same tenant structure.

From policy binders to defensible capability

CPS 234 requires APRA-regulated entities to maintain information security capability commensurate with the size and extent of threats to their information assets - not just documented policies.

Boards must understand whether controls are designed and operating effectively. Spreadsheets and scattered artefacts make that hard to prove under time pressure.

Constant structures CPS 234 domains, assigns owners, collects evidence, and tracks remediation so assurance conversations focus on outcomes rather than file hunting.

Board-ready assurance views

Risk committees need a consistent story: what capability exists, where gaps remain, and what remediation is underway. Constant turns control status and evidence into reporting your board can act on - without implying APRA certification.

Built for APRA-regulated organisations

Banks, insurers, and superannuation trustees subject to CPS 234
Risk and compliance teams preparing for APRA engagement or internal assurance
CISOs and security leaders reporting information security capability to the board
MSPs supporting regulated financial services clients

CPS 234 capability domains

Explore the capability areas Constant organises around CPS 234. Expand each domain for how teams typically evidence and assure it.

Document how information security is governed: roles, policy hierarchy, and accountability. Constant tracks whether policies are current, owned, and linked to the controls they enable - so assurance reviews start from a complete picture rather than a shared drive.

Entities need to know which information assets matter and who owns them. Assessments capture asset scope, classification, and control coverage so capability claims stay tied to what is actually protected.

Map technical and process controls to CPS 234 expectations. Evidence collection shows whether controls are implemented in production (not only described in policy) with remediation workflows when gaps appear.

Schedule and record control testing, penetration testing outcomes, and independent reviews. Findings become tracked work items so testing drives improvement instead of becoming a one-off report.

Maintain incident playbooks, detection evidence, and notification workflows. Constant helps you show that incident capability is defined, tested, and owned before an event forces the issue.

Internal audit findings feed the same remediation backlog as day-to-day assessments. Boards see whether issues are closed, overdue, or accepted with rationale.

What you get with Constant

Capability mapping

Structure assessments around CPS 234 information security capability domains with clear control guidance.

Evidence at control level

Link policies, test results, and operational artefacts to the controls that demonstrate capability.

Assessor-led validation

Certified assessors review critical controls so gaps are identified before APRA or internal audit.

Committee reporting

Summarise open gaps, owners, and remediation progress for risk committees and board packs.