What is the primary objective of ISO 37301?

ISO 37301 specifies requirements for establishing, implementing, maintaining, and improving an effective Compliance Management System (CMS). Published on 13 April 2021 as the first certifiable standard (replacing guidance-only ISO 19600), it uses the Plan-Do-Check-Act (PDCA) cycle and High-Level Structure (HLS) to identify compliance obligations, assess risks and opportunities, and promote a culture of integrity through leadership commitment and continual improvement.

Who is legally or professionally required to comply with ISO 37301?

No organizations are legally required to comply with ISO 37301, as it is a voluntary, certifiable standard applicable to all sizes and sectors. It is professionally adopted by entities seeking third-party validation of their CMS to manage compliance obligations (legal, regulatory, contractual), mitigate risks, and demonstrate integrity to stakeholders like regulators, investors, and partners.

Oes ISO 37301 require an external audit or third-party certification?

ISO 37301 enables but does not require external audits or third-party certification. Certification is optional via accredited certification bodies following a typical three-year cycle with initial assessment and surveillance audits, providing verifiable evidence of CMS conformity.

How often should an assessment for ISO 37301 be performed?

ISO 37301 requires ongoing performance evaluation through monitoring, measurement, internal audits at planned intervals, and management reviews. Internal audits are risk-based (frequent for high-risk areas); certification involves surveillance audits typically annually within a three-year cycle.

What are the consequences of non-compliance with ISO 37301?

Non-conformance with ISO 37301 results in loss of certification, but no direct legal penalties apply as it is voluntary. Internally, it risks ineffective CMS leading to regulatory breaches, reputational damage, fines from unmet obligations, and stakeholder distrust; corrective actions and continual improvement are mandated to address nonconformities.

An ISO 37301 be mapped to other international frameworks?

Yes, ISO 37301 uses the High-Level Structure (HLS) for seamless mapping and integration with other ISO management system standards. Its PDCA cycle and clauses (context, leadership, planning, support, operation, evaluation, improvement) enable combined audits and Integrated Management Systems (IMS) without naming specific frameworks.

What is the first step to begin implementing ISO 37301?

The first step is securing top management commitment and determining the organization's context, including internal/external issues and interested parties' expectations. This initiates the CMS scope, compliance obligations inventory, and risk-based planning per Clauses 4 and 5.

What is the primary objective of APRA CPS 234?

APRA CPS 234 requires regulated entities to maintain an information security capability commensurate with vulnerabilities and threats to information assets. This minimises the likelihood and impact of incidents on confidentiality, integrity, or availability (CIA), including assets managed by related parties or third parties (paragraphs 15–16). Effective from 1 July 2019, it ensures continued sound operation of the entity.

Who is legally or professionally required to comply with APRA CPS 234?

APRA CPS 234 applies to all APRA-regulated entities, including authorised deposit-taking institutions (ADIs), general insurers, life companies, private health insurers, and RSE licensees (paragraph 2). For Heads of groups, it extends group-wide, including non-regulated entities (paragraph 4). Foreign ADIs and certain insurers comply only for Australian branches (paragraph 3).

Does APRA CPS 234 require an external audit or third-party certification?

APRA CPS 234 does not mandate external audits or third-party certifications. It requires review and assurance over information security control design and operating effectiveness, including third-party controls (paragraphs 32–34). Testing must use appropriately skilled, functionally independent specialists (paragraph 30); entities may rely on third-party testing if assessed as commensurate (paragraph 28).

How often should an assessment for APRA CPS 234 be performed?

APRA CPS 234 requires the testing program to be reviewed at least annually or upon material changes to information assets or the business environment (paragraph 31). Testing frequency is commensurate with vulnerability/threat change rates, asset criticality/sensitivity, incident consequences, and exposure to untrusted environments (paragraph 27). Incident response plans must be reviewed and tested annually (paragraph 26).

What are the consequences of APRA CPS 234 non-compliance?

Non-compliance with APRA CPS 234 exposes entities to APRA's prudential enforcement powers under relevant Acts. These include directions for remediation, heightened supervision, or other actions (paragraph 11). Entities must notify APRA within 72 hours of material incidents (paragraph 35) or 10 business days of unremediable material control weaknesses (paragraph 36), triggering scrutiny.

Can APRA CPS 234 be mapped to other international frameworks?

Yes, APRA CPS 234's outcomes-based requirements can be mapped to frameworks like ISO 27001 and NIST Cybersecurity Framework. Its focus on governance, commensurate controls, testing, and third-party assurance aligns with ISO 27001's ISMS and NIST's Identify-Protect-Detect-Respond-Recover functions, enabling operationalisation without prescriptive conflicts.

What is the first step to begin implementing APRA CPS 234?

The first step is for the Board to assume ultimate responsibility and define information security roles and responsibilities (paragraphs 13–14). This establishes governance, followed by classifying information assets by criticality and sensitivity to drive commensurate capability and controls (paragraph 20).

Standards Comparison

ISO 37301 vs APRA CPS 234

ISO 37301

Voluntary

2021

Certifiable international standard for compliance management systems

APRA CPS 234

Mandatory

2019

Australian prudential standard for information security resilience

Quick Verdict

ISO 37301 provides certifiable compliance management for global organizations, while APRA CPS 234 mandates information security governance for Australian financial entities. Companies adopt ISO 37301 for broad integrity assurance; CPS 234 ensures cyber resilience under regulatory oversight.

Compliance Management

ISO 37301

ISO 37301:2021 Compliance management systems – Requirements with guidance

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Certifiable CMS requirements replacing guidance-only ISO 19600
High-Level Structure enables integrated management systems
Risk-based compliance obligations assessment and planning
Mandates leadership commitment and compliance culture
Requires confidential whistleblowing channels and protections

Information Security

APRA CPS 234

APRA Prudential Standard CPS 234 Information Security

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Board ultimate responsibility for information security
72-hour notification for material incidents to APRA
Third-party managed assets full compliance scope
Systematic independent testing of controls
Asset classification by criticality and sensitivity

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

ISO 37301 Details

What It Is

ISO 37301:2021 – Compliance management systems – Requirements with guidance for use is a certifiable international standard for establishing, implementing, maintaining, and improving effective compliance management systems (CMS). It replaces guidance-only ISO 19600, using a risk-based approach, PDCA cycle, and High-Level Structure (HLS) for broad applicability across organizations.

Key Components

Core clauses: context, leadership, planning, support, operation, performance evaluation, improvement.
Identifies compliance obligations, assesses risks/opportunities, sets objectives/controls.
Emphasizes whistleblowing, competence, measurement.
Supports third-party certification via accredited certification bodies.

Why Organizations Use It

Provides external validation, reduces regulatory/reputational risks.
Builds integrity culture, enhances stakeholder trust.
Integrates with ISO 9001/14001/27001; aids ESG/SDGs.
Drives continual improvement, investor confidence.

Implementation Overview

Phased: gap analysis, register building, training, audits, certification.
Scalable for SMEs to enterprises, all sectors.
3-year certification cycle with surveillance audits.

APRA CPS 234 Details

What It Is

APRA Prudential Standard CPS 234 (Information Security) is a binding prudential regulation for APRA-regulated financial institutions in Australia. Effective from 1 July 2019, it requires entities to maintain information security capabilities commensurate with threats and vulnerabilities, minimizing impacts on confidentiality, integrity, and availability (CIA) of information assets, including those managed by third parties. It employs a risk-based, assurance-driven model emphasizing governance, testing, and rapid notification.

Key Components

Board ultimate responsibility (para 13) and defined roles (para 14)
Asset classification by criticality and sensitivity (para 20)
Commensurate controls across asset lifecycle (para 21)
Systematic testing and assurance (paras 27-34)
72-hour notification for material incidents; 10 business days for control weaknesses (paras 35-36) No fixed controls; proportional to risk; integrates with CPS 220/230.

Why Organizations Use It

Mandatory compliance avoids APRA penalties, enforcement
Enhances cyber resilience, third-party oversight
Protects stakeholders, ensures operational continuity
Builds regulatory trust, competitive edge in finance

Implementation Overview

Phased approach: gap analysis, policy framework, asset inventory, controls/testing, third-party assessments. Targets banks, insurers, super funds; ongoing assurance, no external certification but APRA supervision.

Key Differences

Aspect	ISO 37301	APRA CPS 234
Scope	Compliance management systems across all obligations	Information security and cyber resilience
Industry	All sectors, global applicability	Australian financial services only
Nature	Voluntary certifiable standard	Mandatory prudential regulation
Testing	Internal audits, management reviews	Systematic independent control testing
Penalties	Loss of certification	Regulatory sanctions, fines

Scope

ISO 37301

Compliance management systems across all obligations

APRA CPS 234

Information security and cyber resilience

Industry

ISO 37301

All sectors, global applicability

APRA CPS 234

Australian financial services only

Nature

ISO 37301

Voluntary certifiable standard

APRA CPS 234

Mandatory prudential regulation

Testing

ISO 37301

Internal audits, management reviews

APRA CPS 234

Systematic independent control testing

Penalties

ISO 37301

Loss of certification

APRA CPS 234

Regulatory sanctions, fines

Frequently Asked Questions

Common questions about ISO 37301 and APRA CPS 234

ISO 37301 FAQ

APRA CPS 234 FAQ

You Might also be Interested in These Articles...

Practical Implementation Blueprint for Regulation S-K Item 106: Cybersecurity Governance and Risk Management Disclosures in 10-Ks

Step-by-step guide for Item 106 cybersecurity disclosures in 10-Ks: risk management, board oversight, Inline XBRL templates (Dec 2024 compliance). Templates for

NIST CSF 2.0 Govern Function Deep Dive: Building Executive Cybersecurity Governance from Scratch

Step-by-step blueprint for NIST CSF 2.0 Govern function: templates, RACI matrices, metrics to elevate cybersecurity governance to boardroom level. Reduce breach

NIST CSF 2.0: Key Enhancements and How They Address Evolving Cyber Threats

Explore NIST CSF 2.0 updates: Govern function, supply chain security, SME playbooks for ransomware & AI threats. Boost your cyber defenses now!

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how ISO 37301 and APRA CPS 234 compare against other standards

Other ISO 37301 Comparisons

Other APRA CPS 234 Comparisons

What It Is

Key Components

Core clauses: context, leadership, planning, support, operation, performance evaluation, improvement.

Identifies compliance obligations, assesses risks/opportunities, sets objectives/controls.

Emphasizes whistleblowing, competence, measurement.

Supports third-party certification via accredited certification bodies.

What It Is

Key Components

Board ultimate responsibility (para 13) and defined roles (para 14)

Asset classification by criticality and sensitivity (para 20)

Commensurate controls across asset lifecycle (para 21)

Systematic testing and assurance (paras 27-34)

72-hour notification for material incidents; 10 business days for control weaknesses (paras 35-36) No fixed controls; proportional to risk; integrates with CPS 220/230.

Aspect

ISO 37301

APRA CPS 234

Scope

Compliance management systems across all obligations

Information security and cyber resilience

Industry

All sectors, global applicability

Australian financial services only

Nature

Voluntary certifiable standard

Mandatory prudential regulation

Testing

Internal audits, management reviews

Systematic independent control testing

Penalties

Loss of certification

Regulatory sanctions, fines