What is APRA CPS 230?
CPS 230 is the Australian Prudential Regulation Authority's prudential standard on operational risk management, effective 1 July 2025. It applies to every APRA-regulated entity — banks, authorised deposit-taking institutions (ADIs), insurers, and superannuation fund trustees — and requires robust, documented frameworks for identifying, assessing, and managing operational risk. That definition of operational risk explicitly includes technology risk, cyber risk, and third-party service provider risk.
CPS 230 consolidates and replaces several earlier APRA prudential standards, and it represents a significant uplift in operational resilience expectations. Where earlier standards asked whether an entity had policies, CPS 230 asks whether the entity can keep delivering its critical operations through a disruption — and can prove it with testing, tolerance levels, and evidence. Boards are accountable for the outcomes, not just the paperwork.
For Australian financial services organisations, this is not a compliance exercise that can be delegated to a policy template. APRA has been direct that it expects to see operational risk management embedded in day-to-day decision-making, with clear accountability at senior executive level. The standard sits alongside APRA CPS 234, the companion information security standard, and the two are deliberately designed to draw on the same evidence base.
Who does CPS 230 apply to?
CPS 230 applies to all APRA-regulated entities:
- Authorised deposit-taking institutions — banks, credit unions, and building societies
- General insurers and life insurers
- Private health insurers
- RSE licensees — superannuation fund trustees
The direct obligations sit with those entities, but the downstream implications reach much further. Any technology service provider supplying an APRA-regulated entity will feel CPS 230 through procurement, contracts, and audit requests. Regulated entities are required to assess and manage third-party technology risk, maintain a register of material service providers, and hold evidence of supplier resilience controls. If your organisation provides managed IT, cloud hosting, software, or consulting to a bank, insurer, or super fund, expect CPS 230-shaped due diligence questionnaires, tighter contractual protections, and requests for evidence such as ISO 27001 certification, penetration test summaries, and business continuity test results.
Smaller financial services businesses — boutique insurers, credit unions, and superannuation administrators — face the same standard as the major banks, proportionate to their size and complexity. Proportionality affects how the requirements are met, not whether they apply.
What CPS 230 requires for technology and IT
Five technology requirements do most of the work in a CPS 230 program.
1. Business continuity plans. Entities must maintain documented business continuity plans (BCPs) that are capable of maintaining critical operations during disruption. Plans must be tested regularly against severe but plausible scenarios — not optimistic ones — and test outcomes must be documented with remediation of identified gaps. APRA expects annual testing at minimum.
2. Critical system identification. Entities must map the systems and data whose failure would materially impact critical operations. This sounds simple and is not: a critical operation typically depends on an application, an identity platform, a network path, and one or more third parties that were each assessed separately and never together. The mapping must cover those end-to-end dependencies.
3. Technology risk management. Operational risk frameworks must systematically identify, assess, and mitigate technology and cyber risks. This connects directly to the information security capability required by CPS 234 and to frameworks such as the Essential Eight, which provide the control baseline that technology risk assessments measure against.
4. Third-party provider risk. Material service provider arrangements require due diligence before engagement, contractual protections, ongoing monitoring against agreed standards, and contingency plans for provider failure. Fourth-party dependencies — your provider's providers — are explicitly in scope.
5. Incident response. Entities must maintain documented capability to detect, contain, and recover from operational incidents, including cyber events. Incident classification processes need to be defined in advance, because notification timelines are not a reasonable moment to be deciding what counts as material.
How Microsoft 365 and Azure support CPS 230 compliance
For financial services organisations already running on the Microsoft stack, the majority of CPS 230 technology requirements map onto capabilities that are either already licensed or available at incremental cost.
Azure Backup provides geo-redundant business continuity for critical data, with recovery procedures that can be tested and evidenced — directly supporting the BCP testing obligation. Recovery time and recovery point objectives can be expressed, tested against real restore exercises, and reported.
Microsoft Entra ID Conditional Access manages identity and access risk — the control plane that determines who can reach which systems under which conditions. For CPS 230 purposes, this provides the documented access controls and the audit trail that operational risk assessments require.
Microsoft Defender for Business provides cyber threat detection and incident response capability across endpoints, supporting both the technology risk management and incident response requirements.
Microsoft Purview covers information governance and data risk management — classification, retention, data loss prevention, and the ability to demonstrate where sensitive information lives and who can access it.
Azure Monitor and Microsoft Defender for Cloud provide technology risk visibility across cloud workloads, giving risk teams the telemetry needed to monitor critical systems and evidence that monitoring to assessors.
Critically for third-party risk documentation, Microsoft 365 itself holds ISO 27001, SOC 1, and SOC 2 Type II certifications. When an APRA-regulated entity assesses Microsoft as a material service provider — or when your organisation is assessed as part of a chain that includes Microsoft services — these certifications provide the independent assurance evidence the standard expects.
Licensing and capability are not the same thing, however. The controls only count toward CPS 230 when they are configured, tested, and documented. An Entra ID tenant with Conditional Access policies that were never reviewed, or an Azure Backup configuration that has never had a restore test, does not satisfy an assessor — it creates a finding.
CPS 230 and third-party technology providers
CPS 230 places significant obligations on regulated entities regarding their technology service providers, and this is where many organisations underestimate the workload. APRA expects entities to conduct due diligence on providers before engagement, maintain contractual protections including audit rights, monitor provider performance against agreed service levels, and hold contingency plans for provider failure.
In practice, this means every material technology arrangement needs a current risk assessment, a contract that includes the required protections, monitoring evidence, and an exit or continuity plan. For entities running dozens of SaaS and managed service arrangements, building and maintaining this register is a substantial program of work.
Mycelium 365 supports CPS 230 third-party risk requirements from the provider side. As a managed service provider to Australian financial services organisations, we provide:
- Service Level Agreements with defined response and recovery times that map to client tolerance levels
- ISO 27001-aligned security practices across our delivery operations
- Monthly reporting on system availability, security posture, and patch compliance in a format suitable for client risk registers
- Evidence packs suitable for APRA audit purposes, including architecture documentation, incident history, and business continuity arrangements
Organisations assessing their own provider arrangements should expect — and welcome — this level of transparency. A provider that cannot produce resilience evidence is itself a CPS 230 risk.
How Mycelium 365 helps Australian financial services firms with CPS 230
Mycelium 365 assists Australian financial services organisations in meeting CPS 230 requirements through its Governance and Compliance Readiness advisory service. The engagement is structured around the evidence APRA expects to see, not around policy documents that sit in a drawer.
The work typically covers five areas:
- Technology risk assessment against CPS 230 requirements — a gap analysis of current controls, documentation, and testing against the standard, producing a prioritised remediation roadmap.
- Business continuity plan development and testing — documenting BCPs for critical operations and running real restore and failover exercises, with test outcomes and remediation actions recorded.
- Microsoft 365 and Azure configuration to meet CPS 230 technology standards — Entra ID Conditional Access, Defender for Business, Azure Backup, Purview, and monitoring configured to the level the assessment requires.
- Third-party risk documentation and evidence packs — building the provider register, reviewing contracts for required protections, and assembling audit-ready evidence.
- Quarterly compliance reporting — keeping the risk register, test results, and remediation status current so the annual cycle is a review, not a rebuild.
Mycelium 365 is a Microsoft Solutions Partner working exclusively in the Microsoft stack, which means the advisory work and the technical remediation are delivered by the same team. Contact Mycelium 365 for a CPS 230 readiness conversation.
How to prepare for CPS 230 compliance — step by step
For organisations beginning the work now, this is the sequence we recommend.
Step 1 — Map your critical operations and systems. Identify which business operations and technology systems are critical — those whose failure would materially impact your ability to provide services or meet regulatory obligations. This mapping is the foundation of your CPS 230 program; every subsequent step depends on it being honest and complete.
Step 2 — Conduct a technology risk assessment. Assess your current technology risk posture against CPS 230 requirements, including cyber risks, data risks, and third-party technology provider risks. Identify gaps in controls, documentation, and testing, and prioritise them by the critical operations they affect.
Step 3 — Implement Microsoft 365 and Azure controls. Configure Microsoft 365 Business Premium and Azure to address the identified gaps — Entra ID for identity risk, Defender for Business for cyber risk, Azure Backup for business continuity, and Microsoft Purview for information risk management. Configuration must be documented to count as evidence.
Step 4 — Develop and test business continuity plans. Document BCPs for critical operations and technology systems, then test recovery procedures. APRA expects annual BCP testing at minimum, with evidence of test outcomes and remediation of identified gaps. Test against severe but plausible scenarios.
Step 5 — Manage and document third-party technology risk. Review contracts with technology service providers for CPS 230-required protections: audit rights, SLA commitments, incident notification obligations, and exit provisions. Maintain a register of third-party providers with risk ratings, and keep it current as arrangements change.
CPS 230 is best understood as an operating discipline rather than a project with an end date. Organisations that build the evidence base into their quarterly rhythm find that audits become routine — and that the same discipline that satisfies APRA also makes the business measurably more resilient.