What is the primary objective of APRA CPS 234?

APRA CPS 234 requires regulated entities to maintain an information security capability commensurate with vulnerabilities and threats to information assets, minimizing the likelihood and impact of incidents on confidentiality, integrity, or availability (CIA). This capability must enable continued sound operation and explicitly covers assets managed by related parties or third parties (paragraphs 15-16). Boards hold ultimate responsibility (paragraph 13), with requirements commencing 1 July 2019.

Who is legally or professionally required to comply with APRA CPS 234?

APRA CPS 234 applies to all APRA-regulated entities, including authorised deposit-taking institutions (ADIs), general insurers, life companies, private health insurers, and RSE licensees. It covers Heads of groups on a group basis, extending to non-regulated group entities (paragraphs 2-4). Foreign ADIs, Category C insurers, and eligible foreign life insurers comply for Australian branch operations only (paragraph 3). Third-party managed assets comply from the earlier of contract renewal or 1 July 2020 (paragraph 6).

Does APRA CPS 234 require an external audit or third-party certification?

APRA CPS 234 does not mandate external audit or third-party certification but requires internal audit to review design and operating effectiveness of information security controls, including those of related parties and third parties (paragraphs 32-34). Internal audit must assess third-party assurance if relying on it for material-impact assets (paragraph 34). Systematic testing must use appropriately skilled, functionally independent specialists (paragraph 30); external experts may be engaged to ensure independence.

How often should an assessment for APRA CPS 234 be performed?

APRA CPS 234 requires review of the systematic testing program at least annually or upon material change to information assets or the business environment (paragraph 31). Testing frequency is commensurate with vulnerability/threat change rate, asset criticality/sensitivity, incident consequences, untrusted environment exposure, and asset changes (paragraph 27). Information security response plans must be reviewed and tested annually (paragraph 26). Internal audit provides ongoing assurance.

What are the consequences of non-compliance with APRA CPS 234?

Non-compliance with APRA CPS 234 exposes entities to APRA's prudential powers, including directions, increased supervision, or other enforcement actions under enabling Acts. Entities must notify APRA within 72 hours of material incidents (paragraph 35) or 10 business days of material control weaknesses not remediable timely (paragraph 36). APRA may adjust requirements in writing (paragraph 9), with failures risking operational disruption and stakeholder harm.

Can APRA CPS 234 be mapped to other international frameworks?

Yes, APRA CPS 234's outcomes-based requirements for governance, controls, testing, and third-party management align with frameworks like ISO 27001 and NIST Cybersecurity Framework. Entities commonly map CPS 234's commensurate capability (paragraph 15), asset classification (paragraph 20), and systematic testing (paragraph 27) to NIST functions (Identify, Protect, Detect, Respond, Recover) or ISO controls, enabling proportional implementation while meeting APRA's board accountability and notification timelines.

What is the first step to begin implementing APRA CPS 234?

The first step for implementing APRA CPS 234 is for the Board to assume ultimate responsibility and define information security roles and responsibilities across the entity (paragraphs 13-14). This establishes governance, followed by classifying information assets by criticality and sensitivity to drive commensurate controls and testing (paragraph 20).

What is the primary objective of SAMA CSF?

The primary objective of SAMA CSF is to create a common approach for addressing cybersecurity across SAMA-regulated financial institutions, achieve an appropriate maturity level of cybersecurity controls, and ensure cybersecurity risks are properly managed. Version 1.0 (May 2017) prescribes principles, objectives, and control considerations across four domains—Cyber Security Leadership and Governance, Risk Management and Compliance, Operations and Technology, and Third Party Cyber Security—underpinned by a six-level maturity model targeting at least Level 3 (Structured and Formalized).

Who is legally or professionally required to comply with SAMA CSF?

SAMA CSF is mandatory for all SAMA-regulated entities, including banks, insurance and reinsurance companies, financing companies, credit bureaus, and financial market infrastructure providers operating in Saudi Arabia. All domains apply fully to banks; non-banks may exclude certain subdomains (e.g., payment systems unless handling cardholder data or SWIFT). Boards, senior management, CISOs, and compliance functions bear accountability, with third-party providers strongly recommended to align for ecosystem compliance.

Does SAMA CSF require an external audit or third-party certification?

SAMA CSF requires periodic self-assessments using SAMA-provided questionnaires and supervisory review by SAMA, but does not mandate external third-party certification. Internal audits by independent functions are required per accepted standards; SAMA conducts reviews and audits to verify maturity (minimum Level 3). Evidence portfolios—including policies, risk registers, and control artifacts—support self-assessments and potential SAMA-mandated external audits.

How often should an assessment for SAMA CSF be performed?

SAMA CSF assessments must be performed periodically, including annual reviews of critical assets and as triggered by events like projects, changes, outsourcing, or new products. Self-assessments via SAMA questionnaires evaluate maturity across domains; penetration testing is required annually for customer-facing and internet-exposed services. Continuous monitoring via KPIs (Level 3) and KRIs (Level 4+) supports ongoing evaluation.

What are the consequences of non-compliance with SAMA CSF?

Non-compliance with SAMA CSF triggers regulatory enforcement actions by SAMA, including supervisory scrutiny, remediation demands, mandated audits, operational restrictions, and potential fines under broader banking laws. Inadequate maturity below Level 3 risks formal findings, elevated oversight, reputational damage, and systemic interventions; incident mishandling requires immediate SAMA notification, with media restrictions.

Can SAMA CSF be mapped to other international frameworks?

Yes, SAMA CSF aligns conceptually with international frameworks such as NIST CSF, ISO 27001, PCI-DSS, and BASEL, enabling control mappings for integrated compliance. Its principle-based structure and maturity model map to NIST functions (Identify, Protect, Detect, Respond, Recover) and ISO 27001's ISMS; explicit references mandate PCI-DSS/SWIFT CSCF for relevant subdomains, reducing duplication via vendor tools and GRC platforms.

What is the first step to begin implementing SAMA CSF?

The first step to implement SAMA CSF is to secure Board and senior management sponsorship, establish a project charter, and conduct an initial gap analysis and maturity assessment against the framework's domains and six-level model. Appoint program leadership (e.g., CISO oversight), inventory applicable controls, and produce a baseline maturity report targeting Level 3 minimum.

Standards Comparison

APRA CPS 234 vs SAMA CSF

APRA CPS 234

Mandatory

2019

Australian prudential standard for financial sector information security

SAMA CSF

Mandatory

2017

Saudi regulatory framework for financial cybersecurity

Quick Verdict

APRA CPS 234 mandates information security resilience for Australian financial firms with strict notifications, while SAMA CSF requires maturity-based controls for Saudi institutions. Both ensure cyber resilience; firms adopt them for regulatory compliance and operational trust.

Information Security

APRA CPS 234

APRA Prudential Standard CPS 234 Information Security

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Board ultimate responsibility for information security
72-hour APRA notification for material incidents
Extends to third-party managed information assets
Risk-based systematic control testing and assurance
Asset classification by criticality and sensitivity

Cybersecurity

SAMA CSF

Saudi Arabian Monetary Authority Cyber Security Framework

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Six-level maturity model with Level 3 baseline
Four core domains and detailed subdomains
Board oversight and independent CISO mandate
Principle-based risk management with waivers
Third-party security and vendor controls

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

APRA CPS 234 Details

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a binding regulation for Australian financial institutions. Effective from 1 July 2019, it mandates resilience against cyber threats via commensurate information security capabilities. Its risk-based approach emphasizes governance, controls, and assurance across entity and third-party assets.

Key Components

Board accountability and defined roles/responsibilities
Asset classification by criticality/sensitivity
Lifecycle controls, systematic testing, internal audit
Incident response plans with annual testing
**Notifications72 hours for incidents, 10 days for weaknesses No fixed controls; focuses on outcomes with ~24 core paragraphs.

Why Organizations Use It

Ensures prudential compliance, minimizes incident impacts on customers. Reduces operational risks, builds stakeholder trust, avoids penalties. Enhances resilience in complex ecosystems with third-parties.

Implementation Overview

Phased: gap analysis, policy framework, asset inventory, testing programs. Applies to APRA-regulated entities (banks, insurers, super funds). Requires ongoing assurance, no certification but APRA supervision.

SAMA CSF Details

What It Is

The Saudi Arabian Monetary Authority Cyber Security Framework (SAMA CSF), Version 1.0 (May 2017), is a mandatory regulatory framework for SAMA-regulated financial institutions in Saudi Arabia. It prescribes governance, controls, and a maturity model to detect, resist, respond, and recover from cyber threats, using a principle-based, risk-oriented approach aligned with NIST and ISO 27001.

Key Components

Four domains: Cyber Security Leadership & Governance, Risk Management & Compliance, Operations & Technology, Third-Party Security.
Subdomains with principles, objectives, and control considerations.
Six-level maturity model (0-5), minimum Level 3 (structured/formalized).
Self-assessment via questionnaire; SAMA audits.

Why Organizations Use It

Mandatory for banks, insurers, finance firms to avoid penalties, audits.
Builds resilience, efficiency, competitive edge in digital economy.
Enhances risk intelligence, vendor management, stakeholder trust.

Implementation Overview

Phased: initiation/gap analysis, risk assessment, design/deployment, operate/audit.
Targets Saudi financial sector; board sponsorship, CISO role essential.
Iterative for maturity progression (179 words).

Key Differences

Aspect	APRA CPS 234	SAMA CSF
Scope	Information security governance, controls, testing, third-parties	Four domains: governance, risk mgmt, operations, third-party
Industry	Australian financial institutions (ADIs, insurers, superannuation)	Saudi financial institutions (banks, insurance, financing, credit bureaus)
Nature	Mandatory prudential standard with APRA notifications	Mandatory framework with maturity model self-assessments
Testing	Systematic, independent testing; internal audit; annual reviews	Periodic reviews, audits, penetration tests; maturity levels
Penalties	Supervisory actions, directions, penalties via prudential powers	Supervisory actions, remediation demands, potential fines

Scope

APRA CPS 234

Information security governance, controls, testing, third-parties

SAMA CSF

Four domains: governance, risk mgmt, operations, third-party

Industry

APRA CPS 234

Australian financial institutions (ADIs, insurers, superannuation)

SAMA CSF

Saudi financial institutions (banks, insurance, financing, credit bureaus)

Nature

APRA CPS 234

Mandatory prudential standard with APRA notifications

SAMA CSF

Mandatory framework with maturity model self-assessments

Testing

APRA CPS 234

Systematic, independent testing; internal audit; annual reviews

SAMA CSF

Periodic reviews, audits, penetration tests; maturity levels

Penalties

APRA CPS 234

Supervisory actions, directions, penalties via prudential powers

SAMA CSF

Supervisory actions, remediation demands, potential fines

Frequently Asked Questions

Common questions about APRA CPS 234 and SAMA CSF

APRA CPS 234 FAQ

SAMA CSF FAQ

You Might also be Interested in These Articles...

From Hygiene to Governance: How to Scale Cyber Essentials into a Full ISO 27001 ISMS in 2026

Discover how to scale Cyber Essentials into a full ISO 27001 ISMS in 2026. Reuse evidence, map controls, meet DORA & NIS2 rules and win enterprise contracts.

Measuring CIS Controls v8.1 in the Real World: KPIs, Dashboards, and Automated Evidence for Continuous Assurance

Master CIS Controls v8.1 measurement with essential KPIs, executive-ready dashboards, and automated evidence collection for continuous assurance. Make complianc

Step-by-Step Implementation Guide to ISO 27701: Building a Privacy Information Management System (PIMS) on Your ISO 27001 Foundation

Implement ISO 27701 on your ISO 27001 foundation with this actionable guide. Tackle PII controls, audit evidence, GDPR integration. Templates, checklists for 20

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how APRA CPS 234 and SAMA CSF compare against other standards

Other APRA CPS 234 Comparisons

Other SAMA CSF Comparisons

What It Is

Key Components

Board accountability and defined roles/responsibilities

Asset classification by criticality/sensitivity

Lifecycle controls, systematic testing, internal audit

Incident response plans with annual testing

**Notifications72 hours for incidents, 10 days for weaknesses No fixed controls; focuses on outcomes with ~24 core paragraphs.

What It Is

Key Components

Four domains: Cyber Security Leadership & Governance, Risk Management & Compliance, Operations & Technology, Third-Party Security.

Subdomains with principles, objectives, and control considerations.

Six-level maturity model (0-5), minimum Level 3 (structured/formalized).

Self-assessment via questionnaire; SAMA audits.

Aspect

APRA CPS 234

SAMA CSF

Scope

Information security governance, controls, testing, third-parties

Four domains: governance, risk mgmt, operations, third-party

Industry

Australian financial institutions (ADIs, insurers, superannuation)

Saudi financial institutions (banks, insurance, financing, credit bureaus)

Nature

Mandatory prudential standard with APRA notifications

Mandatory framework with maturity model self-assessments

Testing

Systematic, independent testing; internal audit; annual reviews

Periodic reviews, audits, penetration tests; maturity levels

Penalties

Supervisory actions, directions, penalties via prudential powers

Supervisory actions, remediation demands, potential fines