APRA CPS 230 & CPS 234 for superannuation trustees

Super trustees outsource administration, custody and investment management — so CPS 230's material service provider oversight is the biggest task, and it is already in force. Fourth-party transparency and evidenced contract clauses are exactly where spreadsheet registers fall over.

Try it on sample documents →Book a demo

Customers work in their own workspace at banking.cybersentien.com, prepared when the subscription starts. The try-out runs on sample data.

Service provider oversight · CPS 230 & CPS 234

What you get

RSE licensees meet CPS 230 and CPS 234 from one evidence base, with the register and fourth-party transparency that heavy outsourcing — administration, custody, investment — demands: evidenced contract clauses, board packs, no false green.

Defensible accuracy, with less consultant overhead.

Frameworks covered

Each framework links to its own page.

APRA CPS 234 (Information Security)

APRA CPS 230 (Operational Risk)

APRA CPS 220 (Risk Management / Model Risk)

Third-Party Risk Management (NIST 800-161 / CPS 230)

Breach Reporting (OAIC NDB / CPS 234)

ASD Essential EightConsultant-grade depth

What it covers today

Across the APRA standards: a material service provider register with the required attributes and fourth-party visibility, CPS 234 information-security posture, and a board & regulator pack — all evidence-led. CyberSentien prepares the evidence; it does not replace an APRA-appointed reviewer, and nothing shows green without evidence.

Pricing

Enterprise from $64,467 / yr, scoped with you.

See all pricing →

Your workspace

Try it on the shared demo today. For a subscription, the deployment model, tenancy and data boundary are agreed with you before purchase, and your evidence is hosted in Australia.

See it working

Open the console on sample documents now, or tell us where you sit and we'll send a personal demo link for your own evidence.

Try it on sample documents →Request a demo

Frequently asked

Does CPS 230 apply to superannuation funds?

Yes. RSE licensees (super trustees) are APRA-regulated and have had to meet CPS 230 since it commenced on 1 July 2025, with particular focus on service provider oversight given heavy outsourcing.

What is the super trustee's biggest CPS 230 task?

Material service provider oversight — administration, custody and investment providers must be in the register with evidenced contract clauses and fourth-party transparency.

Does CyberSentien cover CPS 234 for super funds too?

Yes. Trustees assess CPS 234 information security and CPS 230 resilience from one evidence base, reusing shared controls.

APRA CPS 234 · Third-party risk (TPRM) · For banks & ADIs