APRA CPS 230 & CPS 234 for insurers

CPS 230 already applies to insurers: claims, policy administration and payments are critical operations that need tolerance levels and material service provider oversight — evidenced, not asserted. CPS 234 sits alongside it, and most teams still assemble both from spreadsheets the week before a review.

Try it on sample documents →Book a demo

Customers work in their own workspace at banking.cybersentien.com, prepared when the subscription starts. The try-out runs on sample data.

CPS 230 operational resilience · CPS 234 information security

What you get

General, life and private health insurers assess CPS 230 operational resilience and CPS 234 information security from one evidence base — claims, policy administration and payments as critical operations, with regulator-ready packs. Never a false green.

Defensible accuracy, with less consultant overhead.

Frameworks covered

Each framework links to its own page.

APRA CPS 230 (Operational Risk)

APRA CPS 234 (Information Security)

APRA CPS 220 (Risk Management / Model Risk)

Third-Party Risk Management (NIST 800-161 / CPS 230)

Breach Reporting (OAIC NDB / CPS 234)

ASD Essential EightConsultant-grade depth

What it covers today

Evidence-led posture across the APRA standards: critical-operations and tolerance framing for claims / policy / payments, a material service provider register, and a board & regulator pack. CyberSentien is the evidence layer an insurer or its reviewer works from — it does not replace an APRA-appointed reviewer, and nothing shows green without evidence.

Pricing

Enterprise from $64,467 / yr, scoped with you.

See all pricing →

Your workspace

Try it on the shared demo today. For a subscription, the deployment model, tenancy and data boundary are agreed with you before purchase, and your evidence is hosted in Australia.

See it working

Open the console on sample documents now, or tell us where you sit and we'll send a personal demo link for your own evidence.

Try it on sample documents →Request a demo

Frequently asked

Does CPS 230 apply to insurers?

Yes. General, life and private health insurers are APRA-regulated and have had to meet CPS 230 operational risk obligations since it commenced on 1 July 2025, alongside CPS 234.

How does CyberSentien help insurers specifically?

It assesses critical operations (claims, policy administration, payments), tolerance levels and material service providers against real evidence, producing regulator-ready packs.

Does it perform the APRA review?

No. It prepares evidence-based readiness; the independent review remains with an APRA-appointed reviewer or assurance practitioner.

APRA CPS 230 · APRA CPS 234 · For banks & ADIs