Strengthening Operational Resilience and Security for APRA CPS 230 and CPS 234

For Australian financial institutions, meeting APRA expectations now means proving resilience in a world of cloud services, third-party dependencies and persistent cyber threats, as well as satisfying compliance requirements. Prudential Standards CPS 230 and CPS 234 raise the bar for both operational continuity and information security, pushing organisations to modernise how they protect critical services, data and users.

The timelines make the point. CPS 234 has been in force since July 2019. CPS 230 has applied since 1 July 2025, and the transition period for pre-existing service provider arrangements ended on 1 July 2026. Both standards are now fully in effect, and for most institutions the question has moved from how the framework is designed to whether the evidence holds up.

What we are hearing from financial institutions is that the regulatory burden goes well beyond adding more controls. The challenge is proving resilience across a much more complex operating environment. With growing dependence on cloud services, third parties and distributed users, many teams are finding that traditional approaches make it harder to meet rising regulatory expectations efficiently.

Understanding the Mandates

While CPS 230 and CPS 234 address different areas, together they reinforce a common expectation: financial institutions must be able to protect critical assets and continue operating during disruption.

CPS 230: Operational Risk Management

Focuses on resilience, business continuity and third-party risk. Institutions must identify critical operations, define disruption tolerances and maintain service continuity during severe events. APRA names the operations it expects to be treated as critical at a minimum: payments, deposit-taking, custody, settlements and clearing for banks; claims processing for insurers; investment management and fund administration for superannuation trustees. Each needs Board-approved tolerance levels, a credible business continuity plan tested against severe but plausible scenarios, and a register of material service providers. A material operational risk incident must be notified to APRA within 72 hours, and a disruption to a critical operation outside tolerance within 24 hours.

CPS 234: Information Security

Focuses on safeguarding information assets through effective security controls, testing, governance and incident response. The Board is ultimately responsible for information security, controls must be proportionate to the sensitivity and criticality of each asset, and their effectiveness must be tested systematically. Material incidents must be notified to APRA within 72 hours, and material control weaknesses that cannot be remediated promptly within 10 business days. An incident reported under CPS 234 does not need to be reported again under CPS 230.

How Zscaler Helps Regulated Entities Comply

To support these security and resilience mandates, the Zscaler Zero Trust Exchange™ provides a cloud-native architecture that eliminates implicit trust. Operating as a globally distributed service, it enforces strict, identity-based, least-privilege access and performs continuous inline inspection across the internet, SaaS and private applications.

Because every connection is brokered and inspected, every policy decision is also logged: who accessed what, which threat was blocked, which configuration changed. That telemetry, exported to your SIEM or GRC platform, is the evidence base that both standards, and your auditors, ask for.

Governance, risk appetite and regulatory reporting remain the responsibility of the regulated entity. Zscaler provides the architectural enforcement and technical controls that support APRA-regulated entities in meeting their obligations.

How Zscaler Supports CPS 230

• Improve resilience without relying on legacy infrastructure

By removing dependence on centralised VPNs and traditional perimeter controls, Zscaler helps reduce single points of failure and supports more resilient access to critical applications. In a hub-and-spoke design, one failed concentrator or one compromised branch can become a disruption to payments or claims processing. Connecting users directly to the applications they are authorised to use removes that path.

• Maintain access during disruption

Capabilities such as Business Continuity Cloud, part of Zscaler Resilience, help organisations preserve secure user access during major outages or disruptive events. It provides a customer-specific backup instance, isolated from the primary cloud, that maintains equivalent security policy during failover rather than bypassing controls to restore connectivity. Private Service Edge offers a local on-ramp, and disaster recovery mode lets Zscaler Client Connector fall back to pre-defined emergency policies. Our Resilience Audit helps teams rehearse failover against their own recovery time objectives, which supports the testing CPS 230 requires, including scenarios where a material service provider fails.

• Improve visibility across third-party services

With Zscaler Digital Experience (ZDX), teams can monitor the digital experience across users, SaaS platforms and service providers, helping support oversight of critical external dependencies. When a disruption occurs, ZDX shows whether it originated in your own environment, with an ISP or with a SaaS provider. That is the kind of evidence CPS 230 expects when you monitor material service providers against agreed service levels.

• Support local enforcement and data handling requirements

Zscaler's presence in Australia helps organisations align security enforcement more closely with local operational and data handling expectations. CPS 230 requires entities to assess the risks of geographic location and to notify APRA before entering a material offshoring arrangement, so knowing where traffic is processed and where logs are held is part of the assessment.

• Support your due diligence on Zscaler itself

CPS 230 treats providers of risk management and core technology services as material unless the entity can justify otherwise, so a security platform that supports critical operations is likely to appear on your register. We built the CPS 230 guide on that assumption. To support your assessment, Zscaler provides independent assurance, including IRAP assessment at the PROTECTED level, SOC 2 Type II and ISO/IEC 27001, through the Zscaler Compliance Center; live availability and performance data on the Zscaler Trust Portal; contractual SLAs; and open standards such as SAML, SCIM, IPsec and GRE that support an orderly exit if one is ever needed.

How Zscaler Supports CPS 234

• Reduce attack surface and limit lateral movement

Zscaler connects users directly to approved applications rather than placing them on the corporate network, helping reduce exposure and contain compromise. With Zscaler Private Access (ZPA), private applications are not reachable from the internet, so there is nothing for an attacker to scan, and a compromised account reaches only the applications that user was entitled to.

• Inspect traffic and stop threats inline

Inline inspection and advanced threat protection help identify malicious activity before it reaches users or sensitive environments. Zscaler Internet Access (ZIA) inspects internet and SaaS traffic, including encrypted traffic, with cloud firewall, intrusion prevention, DNS security and sandboxing applied in a single pass.

• Protect sensitive data wherever it moves

DLP and CASB capabilities help organisations discover, classify and protect sensitive information across web, SaaS and private application traffic. Exact data match, file fingerprinting and optical character recognition let you apply controls proportionate to the sensitivity of each information asset, which is what CPS 234 asks of control design.

• Strengthen control consistency in hybrid environments

Zscaler applies policy more consistently across branch offices, remote users, cloud workloads and third-party access models. One policy, enforced everywhere and logged on every transaction, also gives you continuous evidence of control effectiveness, far more than a point-in-time sample, which supports the systematic testing CPS 234 requires.

The Next Test: Extending the Same Principles to AI

What we are seeing is Boards shifting the question from "are we secure?" to "can we keep delivering critical operations when something we depend on fails?" APRA's April 2026 letter on artificial intelligence raises that bar again. AI agents, AI built into supplier platforms and staff using unapproved AI tools bring new identities, new data flows and new fourth-party dependencies. APRA has said it expects enforceable preventative controls and continuous assurance, and that policy direction and after-the-fact detection on their own fall short.

The Zero Trust principles that underpin CPS 230 and CPS 234 now have to extend to AI: verify every identity, human or machine, and inspect every flow. Institutions that treat these standards as the foundation for governing AI will be best placed to adopt it with confidence. Those that treat them as a finished compliance exercise will be revisiting the same gaps under a new heading.

What Remains With the Regulated Entity

Zscaler provides technical controls, telemetry and architecture. Risk appetite, the designation of critical operations, tolerance levels, Board approvals, materiality decisions and notifications to APRA stay with the institution. Nothing Zscaler provides replaces your own legal, regulatory or prudential assessment.

Simplify Your Compliance Journey

Navigating APRA's requirements is a continuous journey, and it calls for a unified approach to security and resilience that serves both standards at once. The Zscaler Zero Trust Exchange gives financial institutions a technical foundation that supports both CPS 230 and CPS 234 while allowing them to adopt cloud services with confidence.

To support that work, we have developed a control mapping guide for each standard, and a third for APRA's AI expectations. They work through the requirements one by one, separating what the entity owns from how Zscaler capabilities align, and are written to support control design and evidence discussions with your risk, audit and security teams.

Download the CPS 230 Control Mapping Guide 
Download the CPS 234 Control Mapping Guide
Download the APRA AI Supervisory Expectations Mapping Guide

To discuss how these map to your own critical operations and tolerance levels, contact your Zscaler team.