What is the primary objective of APRA CPS 234?

APRA CPS 234 requires regulated entities to maintain an information security capability commensurate with vulnerabilities and threats to information assets. Effective from 1 July 2019, it aims to minimise the likelihood and impact of information security incidents—including cyber-attacks—on the confidentiality, integrity or availability (CIA) of information assets, explicitly including those managed by related parties or third parties (paragraphs 15–16).

Who is legally or professionally required to comply with APRA CPS 234?

APRA CPS 234 applies to all APRA-regulated entities, including authorised deposit-taking institutions (ADIs), general insurers, life companies, private health insurers, and RSE licensees. It covers Heads of groups on a group basis (paragraph 4), extending to non-regulated group entities, and Australian operations of foreign ADIs, Category C insurers, and eligible foreign life insurance companies (paragraphs 2–3). Third-party managed assets comply from the earlier of contract renewal or 1 July 2020 (paragraph 6).

Does APRA CPS 234 require an external audit or third-party certification?

APRA CPS 234 does not mandate external audits or third-party certifications but requires internal audit to review information security control design and operating effectiveness, including third-party controls (paragraphs 32–34). Internal audit must assess third-party assurance if relying on it for material-impact assets and use appropriately skilled personnel (paragraphs 33–34). Systematic testing must be by functionally independent, skilled specialists (paragraph 30).

How often should an assessment for APRA CPS 234 be performed?

APRA CPS 234 requires the testing program to be reviewed at least annually or upon material changes to information assets or the business environment (paragraph 31). Testing frequency is commensurate with vulnerability/threat change rates, asset criticality/sensitivity, incident consequences, untrusted environment exposure, and asset changes (paragraph 27). Incident response plans must be reviewed and tested annually (paragraph 26).

What are the consequences of non-compliance with APRA CPS 234?

Non-compliance with APRA CPS 234 exposes entities to APRA's prudential powers, including directions, penalties, and heightened supervision under enabling Acts. Entities must notify APRA within 72 hours of material incidents (paragraph 35) or 10 business days of material control weaknesses not remediable timely (paragraph 36), triggering scrutiny. APRA may adjust requirements in writing (paragraph 11), with failures risking operational restrictions and reputational harm.

Can APRA CPS 234 be mapped to other international frameworks?

Yes, APRA CPS 234's outcomes-based requirements for governance, controls, testing, and third-party management align with frameworks like ISO 27001 and NIST Cybersecurity Framework. It emphasises board accountability (paragraph 13), asset classification (paragraph 20), systematic testing (paragraphs 27–31), and notification timelines, enabling mapping without prescribing controls—entities commonly use these for operationalisation while meeting CPS 234's commensurability principle.

What is the first step to begin implementing APRA CPS 234?

The first step for implementing APRA CPS 234 is for the Board to assume ultimate responsibility and define information security roles and responsibilities (paragraphs 13–14). This establishes governance, followed by classifying information assets by criticality and sensitivity to drive commensurate capability, policies, and controls (paragraphs 20–21).

What is the primary objective of AS9110C?

AS9110C's primary objective is to enable aviation maintenance organizations to consistently provide products and services meeting customer and applicable statutory/regulatory requirements while enhancing customer satisfaction through effective QMS application and continual improvement. It incorporates ISO 9001:2015's Annex SL structure across Clauses 4–10, adding maintenance-specific controls like configuration management, product safety, counterfeit parts prevention, traceability, preservation, and human factors to ensure continuing airworthiness in repair stations and MRO providers.

Who is legally or professionally required to comply with AS9110C?

AS9110C applies to organizations whose primary business is aviation maintenance, repair, overhaul (MRO), or continuing airworthiness management services, including repair stations, OEM MRO divisions, and providers at all supply chain levels. It targets civil/military contexts regardless of size, where customer contracts, OEM requirements, or competent authority approvals (e.g., FAA/EASA Part 145) mandate it for market access via IAQG OASIS listing; regulatory requirements override the standard.

Does AS9110C require an external audit or third-party certification?

Yes, AS9110C requires third-party certification through accredited bodies, demonstrated by successful Stage 1 (documentation) and Stage 2 (implementation) audits. The QMS must be fully operational for at least three months, including a full internal audit cycle and management review, before initial certification; ongoing surveillance audits occur annually, with recertification every three years.

How often should an assessment for AS9110C be performed?

AS9110C requires internal audits at planned intervals based on process risk, status, and results, with a full QMS cycle completed before certification. Management reviews occur at regular intervals (e.g., annually or tied to business cycles), evaluating performance data, audits, risks, and improvements; frequency is organization-defined but must cover high-risk processes like configuration management and release to service more often.

What are the consequences of non-compliance with AS9110C?

Non-compliance with AS9110C risks loss of certification, exclusion from OEM contracts and IAQG OASIS, regulatory sanctions (e.g., FAA/EASA Part 145 certificate suspension), safety incidents from poor traceability or counterfeit parts, and financial impacts like rework, AOG downtime, fines, or litigation. It undermines continuing airworthiness, leading to market exclusion and reputational damage.

Can AS9110C be mapped to other international frameworks?

Yes, AS9110C aligns directly with ISO 9001:2015 via its Annex SL high-level structure and shares terminology like documented information and external providers. IAQG correlation matrices facilitate mapping to regulatory frameworks (e.g., FAA/EASA Part 145), enabling integrated management systems without exclusions unless justified in QMS scope.

What is the first step to begin implementing AS9110C?

The first step is to define QMS scope, determine internal/external issues (Clause 4), identify interested parties/regulatory requirements, and conduct a gap analysis against Clauses 4–10. Secure executive sponsorship, map existing processes to AS9110C requirements (using IAQG checklists), and prioritize high-risk areas like operational planning (Clause 8) for a phased implementation plan.

Standards Comparison

APRA CPS 234 vs AS9110C

APRA CPS 234

Mandatory

2019

Australian prudential standard for financial information security resilience

AS9110C

Mandatory

2016

International standard for aviation maintenance quality management.

Quick Verdict

APRA CPS 234 mandates information security resilience for Australian financial institutions with strict notifications, while AS9110C certifies quality management for aviation MROs emphasizing airworthiness. Financial firms comply for prudential regulation; MROs certify for contracts and safety.

Information Security

APRA CPS 234

APRA Prudential Standard CPS 234 Information Security

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Board ultimately responsible for information security oversight
72-hour APRA notification for material incidents
Extends to all third-party managed assets
Systematic risk-based control testing and assurance
Asset classification by criticality and sensitivity

Quality Management

AS9110C

AS9110C: Quality Management Systems for Aviation Maintenance

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Risk-based thinking in planning and operations
Configuration management and traceability controls
Counterfeit and suspect parts prevention
Human factors in root cause analysis
External provider evaluation and control

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

APRA CPS 234 Details

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a binding regulation for Australian financial institutions. Effective July 2019, it mandates resilience against cyber threats via risk-based governance and controls. Scope covers APRA-regulated entities like banks, insurers, and super funds, including third-party assets.

Key Components

Board accountability (para 13), role definitions, policy framework.
Asset classification by criticality/sensitivity (para 20), commensurate controls (para 21).
Incident response plans, systematic testing, internal audit assurance.
72-hour material incident and 10-business-day weakness notifications to APRA. No fixed controls; commensurate with threats, tested independently.

Why Organizations Use It

Mandatory for compliance, avoids penalties and scrutiny. Enhances cyber resilience, protects stakeholders, integrates with CPS 220/230. Builds trust, reduces incident impacts, enables sound operations.

Implementation Overview

Phased: gap analysis, asset inventory, control/testing programs, third-party assessments. Applies to all sizes proportionally; group-wide for Heads. No certification, but APRA expects evidence via audits, reporting.

AS9110C Details

What It Is

AS9110C (AS9110:2016 Rev C) is an international quality management system (QMS) certification standard for aviation maintenance organizations (MROs), repair stations, and continuing airworthiness providers. It builds on ISO 9001:2015 with aerospace-specific requirements, using a risk-based thinking approach via Annex SL high-level structure and PDCA cycle to ensure safe, compliant maintenance.

Key Components

Core clauses 4–10 covering context, leadership, planning, support, operation, evaluation, improvement.
Aviation additions: configuration management, product safety, counterfeit parts prevention, human factors, traceability, external provider controls.
No fixed control count; focuses on documented information and evidence-based conformity.
Certification via IAQG-accredited bodies with OASIS listing.

Why Organizations Use It

Meets customer/OEM contracts and regulatory alignments (FAA/EASA Part 145).
Mitigates safety risks, ensures airworthiness, improves on-time delivery.
Enhances market access, operational efficiency, stakeholder trust.

Implementation Overview

Phased: gap analysis, process design, training, audits (6-12 months typical).
Applies to all MRO sizes globally; requires internal audits, management review before certification.

Key Differences

Aspect	APRA CPS 234	AS9110C
Scope	Information security governance and cyber resilience	Aerospace MRO quality management and airworthiness
Industry	Australian financial services (banks, insurers)	Global aviation maintenance organizations
Nature	Mandatory prudential standard with enforcement	Voluntary certification quality standard
Testing	Systematic independent control testing annually	Internal audits, management reviews, certification audits
Penalties	Supervisory actions, penalties, license risks	Loss of certification, market exclusion

Scope

APRA CPS 234

Information security governance and cyber resilience

AS9110C

Aerospace MRO quality management and airworthiness

Industry

APRA CPS 234

Australian financial services (banks, insurers)

AS9110C

Global aviation maintenance organizations

Nature

APRA CPS 234

Mandatory prudential standard with enforcement

AS9110C

Voluntary certification quality standard

Testing

APRA CPS 234

Systematic independent control testing annually

AS9110C

Internal audits, management reviews, certification audits

Penalties

APRA CPS 234

Supervisory actions, penalties, license risks

AS9110C

Loss of certification, market exclusion

Frequently Asked Questions

Common questions about APRA CPS 234 and AS9110C

APRA CPS 234 FAQ

AS9110C FAQ

You Might also be Interested in These Articles...

The NIS2 "FTE Trap": Why 5 Analysts for 24/7 Security is Actually 8 (and Why the Board Needs to Know)

Exposed: NIS2 FTE Trap math shows 5 analysts fail 24/7 coverage due to sickness, training, leave & 2026 churn. Line-by-line breakdown for compliance. Alert your

SEC Cybersecurity Rules Implementation Guide: Mastering Form 8-K Item 1.05 Materiality Determination and 4-Business-Day Reporting Workflow

Master SEC Form 8-K Item 1.05 compliance with step-by-step materiality assessment, incident workflows & Inline XBRL tagging. Beat the 4-business-day clock. Esse

The SOC Maturity Roadmap: A 5-Step Blueprint for Scaling from Ad-Hoc to Optimized Operations

Unlock SOC excellence with our 5-step maturity roadmap. Compare SOC-CMM, NIST CSF, and CMMC frameworks to scale from ad-hoc to automated operations. Start your

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how APRA CPS 234 and AS9110C compare against other standards

Other APRA CPS 234 Comparisons

Other AS9110C Comparisons

What It Is

Key Components

Board accountability (para 13), role definitions, policy framework.

Asset classification by criticality/sensitivity (para 20), commensurate controls (para 21).

Incident response plans, systematic testing, internal audit assurance.

72-hour material incident and 10-business-day weakness notifications to APRA. No fixed controls; commensurate with threats, tested independently.

What It Is

Key Components

Core clauses 4–10 covering context, leadership, planning, support, operation, evaluation, improvement.

Aviation additions: configuration management, product safety, counterfeit parts prevention, human factors, traceability, external provider controls.

No fixed control count; focuses on documented information and evidence-based conformity.

Certification via IAQG-accredited bodies with OASIS listing.

Aspect

APRA CPS 234

AS9110C

Scope

Information security governance and cyber resilience

Aerospace MRO quality management and airworthiness

Industry

Australian financial services (banks, insurers)

Global aviation maintenance organizations

Nature

Mandatory prudential standard with enforcement

Voluntary certification quality standard

Testing

Systematic independent control testing annually

Internal audits, management reviews, certification audits

Penalties

Supervisory actions, penalties, license risks

Loss of certification, market exclusion