CPS 230 applies to insurers from 1 July 2026: claims, policy administration and payments are critical operations that need tolerance levels and material service provider oversight — evidenced, not asserted. CPS 234 sits alongside it, and most teams still assemble both from spreadsheets the week before a review.
Book a demo → Try it on sample docsThe SOCI Act is Australian, and there is no dedicated SOCI catalogue on the engine yet — this page says so rather than shading it green. The lanes serving the obligations mix Australian depth (Essential Eight, ISM) with internationally used instruments — NIST CSF 2.0, CIS Controls v8 — exactly as live on the catalogue.
Run the frameworks above against synthetic sample documents now, or tell us where you sit and we'll send a gated, revocable demo link.
Yes. General, life and private health insurers are APRA-regulated and must meet CPS 230 operational risk obligations from 1 July 2026, alongside CPS 234 information security.
It assesses critical operations (claims, policy administration, payments), tolerance levels and material service providers against real evidence, producing regulator-ready packs.
No. It prepares evidence-based readiness; the independent review remains with an APRA-appointed reviewer or assurance practitioner.