CPS 234 vs. CPS 230: Navigating Australia’s New Operational Resilience Landscape

The Australian regulatory environment in 2026 has entered a phase of high-definition oversight. For years, financial institutions focused their compliance efforts on APRA CPS 234, a standard that sharpened the industry’s focus on information security and data protection. However, with the commencement of CPS 230 on 1 July 2025, the goalposts have shifted from protecting “bits and bytes” to ensuring the continuity of “critical business services.”

For business leaders and IT professionals, the challenge is no longer just preventing a breach, but proving that the organization can absorb a hit and keep the lights on. While CPS 234 remains the authoritative standard for information security, CPS 230 acts as an umbrella, integrating cybersecurity into a broader framework of operational risk. Navigating this intersection requires a move away from siloed security projects toward a unified architecture of resilience.

The Fundamental Shift: Security vs. Resilience

At its core, CPS 234 is about protection. It mandates that an entity must maintain an information security capability commensurate with its vulnerabilities and threats. As previously covered in Emutare’s APRA CPS 234 Compliance Guide,¹ this includes rigorous asset classification, control testing, and board-level accountability.

In contrast, CPS 230 is about resilience. It replaces older standards on outsourcing and business continuity, requiring firms to identify “critical operations” and set “tolerance levels” for disruptions. If a cyberattack occurs (the domain of CPS 234), the institution must now demonstrate it can recover its critical services within those predefined tolerances (the domain of CPS 230).

The financial stakes of failing to bridge this gap are becoming clearer. According to theReserve Bank of Australia’s Financial Stability Review for March 2026,² while the capital levels of Australian banks remain “unquestionably strong” at a CET1 ratio of 12.3%, the speed at which technological advances can spread a crisis has heightened the need for entities to withstand “severe but plausible stress events.” In 2026, a bank with perfect capital reserves but a fragile IT architecture is considered a systemic risk.

Integrating Identity into the Resilience Framework

One of the most common friction points between these two standards is identity management. Under CPS 234, Public Key Infrastructure (PKI) is primarily a security control used to encrypt data and verify users. However, under CPS 230, PKI becomes a “critical resource” that supports operational continuity.

To learn more about this transition, one should consult Emutare’s Comprehensive Guide to PKI Design and Management.³ In a CPS 230 world, a PKI outage is not just a security incident (it is an operational failure). If your digital certificates expire or your hardware security modules (HSMs) fail, your critical operations, such as real-time payments or customer portals, grind to a halt. Resilience in 2026 requires automated PKI that can self-heal and rotate certificates without manual intervention, ensuring that the “trust engine” of the bank never stops.

The Third-Party Pressure Cooker

Both standards place a heavy emphasis on third-party risk, but they approach it from different angles. CPS 234 requires you to ensure that your service providers have adequate information security controls. CPS 230 goes further, requiring a “Material Service Provider” register and demanding that entities manage the risk of “fourth-party” providers (your vendor’s vendors).

This is a significant operational hurdle. According to ASIC’s Key Issues Outlook for 2026,⁴ the reliance on third parties continues to elevate cyber risk, with regulators urging directors to address vulnerabilities in their supply chains. For many Australian firms, the software-as-a-service (SaaS) tools they rely on are now the primary threat to their operational tolerance levels.

Practical implementation for IT leaders includes:

Service Mapping: Documenting the end-to-end flow of critical operations, including every third-party API and cloud dependency.
Exit Strategies: CPS 230 requires a plan for how to move a critical operation away from a failing provider, a task that is nearly impossible without a flexible, modular security architecture.
Unified Auditing: Using the same architectural review to satisfy both the security mandates of CPS 234 and the resilience mandates of CPS 230.

Architecting for Both: A Strategic Roadmap

How does a firm successfully navigate both landscapes? The answer lies in the Security Architecture Review Processes⁵ championed by Emutare. A modern architecture review must evolve to become a “Resilience Review.”

Instead of asking “Is this system secure?”, the review should ask “What happens to the business when this system fails?”. This involves:

Setting Tolerance Levels: Defining exactly how much data loss or downtime is acceptable for a specific service (e.g., 2 hours for retail payments).
Stress Testing: Simulating a total loss of a primary data center or a major cloud provider to see if the architecture can failover within those limits.
Accountability Mapping: Under the Financial Accountability Regime (FAR), which is now fully active in 2026, individual executives are personally accountable for compliance. Ensuring that your architecture provides clear logging and audit trails is essential for protecting leadership from legal liability.

This integrated approach is important. APRA’s move to business-as-usual supervision from 2028 will shift the model toward “continuous disclosure of an entity’s operational risk posture.” Checkbox compliance is dead; continuous, evidence-based resilience is the new mandate.

Conclusion: The Unified Front

The arrival of CPS 230 does not make CPS 234 obsolete; rather, it gives it a broader purpose. In the 2026 landscape, information security is the foundation upon which operational resilience is built. You cannot have a resilient business service if the underlying data is compromised or the identity system is broken.

By aligning their security architecture, PKI automation, and regulatory governance, Australian financial institutions can transform compliance from a burden into a competitive advantage. The firms that will lead the market in the coming years are those that recognize that trust and continuity are two sides of the same coin.

References

Emutare. (2025). APRA CPS 234: Compliance Guide for Financial Institutions. https://insights.emutare.com/apra-cps-234-compliance-guide-for-financial-institutions/ ↩︎
RBA (2026). Financial Stability Review – March 2026: Resilience of the Australian Financial System. https://www.rba.gov.au/publications/fsr/2026/mar/resilience-of-the-australian-financial-system.html ↩︎
Emutare. (2025). Public Key Infrastructure (PKI) Design and Management: A Comprehensive Guide for Modern Organizations. https://insights.emutare.com/public-key-infrastructure-pki-design-and-management-a-comprehensive-guide-for-modern-organizations/ ↩︎
ASIC.(2026). Key issues outlook 2026. https://www.asic.gov.au/about-asic/news-centre/news-items/key-issues-outlook-2026/ ↩︎
Emutare. (2025). Security Architecture Review Processes: A Comprehensive Guide to Modern Cybersecurity Assessment. https://insights.emutare.com/security-architecture-review-processes-a-comprehensive-guide-to-modern-cybersecurity-assessment/ ↩︎

Related Blog Posts