WELL
Performance-based certification for occupant health in buildings
APRA CPS 234
Australian prudential standard for information security resilience
Quick Verdict
WELL certifies healthy buildings globally via performance verification for occupant well-being. APRA CPS 234 mandates information security for Australian financial entities with strict testing and notifications. Organizations adopt WELL for ESG/branding, CPS 234 for regulatory compliance.
WELL
WELL Building Standard v2
Key Features
- Requires mandatory on-site performance verification testing
- Organized around 10 core health concepts
- Preconditions mandatory plus point-earning Optimizations
- Tiered certification Bronze to Platinum levels
- Supports continuous monitoring compliance pathways
APRA CPS 234
APRA Prudential Standard CPS 234 Information Security
Key Features
- Ultimate Board accountability for information security
- Commensurate controls based on asset criticality and sensitivity
- Systematic independent testing and assurance of controls
- 72-hour APRA notification for material incidents
- Third-party capability assessment and oversight obligations
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
WELL Details
What It Is
WELL Building Standard v2 is a performance-based certification framework administered by the International WELL Building Institute (IWBI). It focuses on designing, operating, and verifying buildings to advance human health and well-being through evidence-based strategies. Its people-first approach emphasizes measurable indoor environmental quality and organizational policies across new and existing structures.
Key Components
- **10 core conceptsAir, Water, Nourishment, Light, Movement, Thermal Comfort, Sound, Materials, Mind, Community (plus Innovation).
- 24 Preconditions (mandatory pass/fail) and 102 Optimizations (point-earning).
- Built on public health research; certification via Bronze (40 points), Silver (50), Gold (60), Platinum (80) with concept minimums at higher tiers.
- Relies on on-site performance verification and continuous monitoring.
Why Organizations Use It
Drives occupant health, productivity, and ESG reporting; complements LEED for dual benefits. Mitigates risks like poor IEQ; boosts rents, retention, and reputation through verified outcomes.
Implementation Overview
Phased: gap analysis, scorecard, documentation, third-party review, testing, recertification every 3 years. Applies to offices, residential, portfolios; cross-functional teams essential for operations and verification.
APRA CPS 234 Details
What It Is
APRA Prudential Standard CPS 234 (Information Security) is a binding prudential regulation from the Australian Prudential Regulation Authority, effective 1 July 2019. It requires APRA-regulated entities—banks, insurers, super funds—to maintain information security capabilities commensurate with threats and vulnerabilities to information assets, minimizing impacts on confidentiality, integrity, and availability. The risk-based approach demands proportionate governance, controls, and assurance.
Key Components
- Board ultimate accountability and defined roles/responsibilities
- Asset identification, classification by criticality/sensitivity
- Commensurate controls across asset lifecycle, including third-parties
- Systematic testing, independent internal audit assurance
- Incident response plans with annual testing; 72-hour APRA notification for material incidents, 10-day for control weaknesses Built on CIA principles; no fixed control count; compliance via demonstrable evidence.
Why Organizations Use It
- Mandatory compliance avoids APRA enforcement, penalties, license risks
- Builds operational resilience, reduces incident impacts
- Enhances customer trust, enables partnerships, cost efficiencies
- Strategic differentiation in regulated financial services
Implementation Overview
Phased: gap analysis, governance/policies, asset register, controls/testing, monitoring. Applies Australia-wide to regulated entities of all sizes; proportionate to threats. Internal audit required; APRA supervisory review.
Key Differences
| Aspect | WELL | APRA CPS 234 |
|---|---|---|
| Scope | Occupant health across 10 concepts (air, water, mind) | Information security governance and cyber resilience |
| Industry | All buildings globally (offices, residential) | Australian financial services (banks, insurers) |
| Nature | Voluntary performance-based certification | Mandatory prudential regulation with enforcement |
| Testing | On-site performance verification, continuous monitoring | Systematic independent control testing, annual reviews |
| Penalties | Loss of certification, no legal penalties | Regulatory sanctions, fines, license restrictions |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about WELL and APRA CPS 234
WELL FAQ
APRA CPS 234 FAQ
You Might also be Interested in These Articles...
From Data Fragments to Strategic Insight: Powering Intelligent Risk Management with Integrated Compliance Monitoring
Transform data fragments into strategic insights with integrated compliance monitoring. Automate real-time risk management, ensure GDPR & SOC 2 compliance, and
Top 5 Reasons Automation Tools Like Vanta Slash SOC 2 Type 2 Timelines from Months to Weeks
Automation tools like Vanta cut SOC 2 Type 2 prep from 6 months to 6 weeks, saving 70% costs. See SignWell examples, AWS/Okta/GitHub integrations. CISOs: Get fi
SOC 2 for Fintech Startups: First 5 Steps to Compliance with Confidentiality Criterion Infographic
First 5 steps to SOC 2 compliance with Confidentiality for fintech SaaS. Infographic maps controls to risks like encryption & TPRM. Integrates GLBA/PCI DSS over
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
ISO 13485 vs ISO 28000
Compare ISO 13485 vs ISO 28000: Medical QMS rigor meets supply chain security resilience. Uncover differences, overlaps & tips for seamless compliance—boost your ops now!
SOC 2 vs CAA
Discover SOC 2 vs CAA: Compare security controls for SaaS with Clean Air Act emissions regs. Key differences, compliance tips & strategies for enterprise success.
GMP vs ISA 95
Discover GMP vs ISA 95: Compare pharma quality regs with enterprise-control integration models. Unlock compliance, efficiency & digital transformation benefits today!