Understand APRA CPS 220 compliance requirements, implementation timelines, and practical steps to ensure your organisation meets prudential standards for information security.
APRA CPS 220 is the Australian Prudential Regulation Authority's comprehensive standard for information security. Issued in December 2018, it replaced the earlier CPS 234 framework and applies to all entities regulated by APRA, including banks, insurers, superannuation funds, and large investment managers.
Unlike generic cybersecurity frameworks, CPS 220 is tailored specifically for Australian financial institutions and sets mandatory minimum requirements. Non-compliance can result in regulatory enforcement action, financial penalties, and reputational damage. For risk managers and compliance officers, understanding these requirements is not optional—it's essential to organisational resilience.
APRA CPS 220 requires organisations to embed information security governance into their enterprise risk management framework. This means:
Risk managers must ensure that information security is not siloed within IT departments but embedded across the entire risk management infrastructure. This includes integrating security considerations into board risk reporting and ensuring executives understand the financial and operational implications of security failures.
Organisations must conduct systematic security risk assessments at least annually. These assessments should identify threats to confidentiality, integrity, and availability of information systems. The key requirements include:
Many organisations maintain separate risk registers for operational risks but fail to properly document information security risks. CPS 220 requires integration of security risks into your enterprise risk register, making them visible to senior management and the board alongside other organisational risks.
APRA CPS 220 mandates strong controls over user access to systems and information. Requirements include:
In practice, this means conducting quarterly access reviews for high-risk systems and maintaining audit trails of all access changes. Many organisations struggle with orphaned accounts and excessive privileged access—these are common audit findings.
Organisations must maintain systems in a secure baseline configuration and apply security patches promptly. This includes:
APRA expects organisations to patch critical vulnerabilities within 30 days and have defined processes for managing patch delays. Risk managers should work with IT teams to establish clear service level agreements for vulnerability remediation and track compliance monthly.
CPS 220 requires appropriate use of cryptography to protect sensitive information. Specific requirements cover:
This extends beyond just banking data to any personal information held by your organisation. Insurance teams managing claims data and property survey information must ensure encryption is in place across all systems storing or transmitting this data.
Begin by conducting a gap assessment against each CPS 220 requirement. Document current state versus required state, prioritise remediation efforts, and establish realistic timelines. Many organisations find it helpful to categorise gaps as critical (immediate risk), important (within 6 months), and desirable (within 12 months).
Designate a Chief Information Security Officer or equivalent role responsible for coordinating compliance efforts. This person should report directly to the Chief Risk Officer or Chief Executive Officer and have direct accountability to the board for information security matters.
Manual spreadsheet tracking of compliance requirements leads to gaps and misses. Enterprise risk platforms like Diogelu enable risk managers to maintain compliance tracking workflows, document evidence of control implementation, and generate automated compliance reports for regulators and senior management. By centralising compliance information alongside risk registers and incident management, organisations create a unified view of their compliance posture.
CPS 220 requires organisations to detect, respond to, and report information security incidents. Develop and regularly test an incident response plan covering:
At least annually, all staff must receive information security training appropriate to their role. Document training completion rates and track performance against a target (typically 95%+ completion). Many breaches result from phishing and social engineering—frontline staff training is as important as technical controls.
Strict compliance requirements can slow development and deployment cycles. Solution: Integrate security requirements into your software development lifecycle from the start. DevSecOps practices allow organisations to build security in rather than bolt it on after development.
Older systems may not support modern controls like multi-factor authentication or encryption. Solution: Develop a system retirement plan with defined timelines for phasing out legacy applications. In the interim, implement compensating controls such as network isolation or enhanced monitoring.
Large organisations with hundreds of systems and thousands of users struggle with visibility. Solution: Implement centralised tools that automatically collect compliance data and flag exceptions. Platforms like Diogelu integrate compliance tracking with your risk management framework, providing dashboard visibility into compliance status across all areas.
APRA conducts supervisory reviews and expects organisations to provide evidence of compliance. Maintain comprehensive documentation including:
These documents should be readily accessible and well-organised. Many organisations discover during APRA reviews that evidence exists but is scattered across multiple systems and hard to locate. Centralised documentation management within a compliance platform prevents these situations.
APRA regularly updates prudential standards based on emerging threats and lessons learned from incidents across the industry. Risk managers should subscribe to APRA's consultation papers and regulatory communications. Stay informed about:
Build flexibility into your compliance program to adapt as requirements evolve. Annual compliance reviews should include consideration of regulatory developments and emerging threats.
APRA CPS 220 compliance is not a one-time project but an ongoing commitment to information security excellence. Risk managers and compliance officers who view CPS 220 as a compliance checkbox rather than a framework for building genuine resilience miss the deeper value of the standard.
Organisations like Diogelu help risk managers embed compliance into everyday operations through integrated risk and compliance management platforms. By connecting compliance tracking, risk registers, incident management, and audit evidence in one system, Diogelu enables teams to maintain comprehensive compliance visibility while reducing manual effort. For more information on managing APRA compliance effectively, visit https://diogelu.com.
Enterprise risk register, compliance tracking, property survey, incident management and claims — all in one platform.
Start free 14-day trial →