Super trustees outsource administration, custody and investment management — so CPS 230's material service provider oversight is the biggest task, and it lands 1 July 2026. Fourth-party transparency and evidenced contract clauses are exactly where spreadsheet registers fall over.
Book a demo → Try it on sample docsThe SOCI Act is Australian, and there is no dedicated SOCI catalogue on the engine yet — this page says so rather than shading it green. The lanes serving the obligations mix Australian depth (Essential Eight, ISM) with internationally used instruments — NIST CSF 2.0, CIS Controls v8 — exactly as live on the catalogue.
Run the frameworks above against synthetic sample documents now, or tell us where you sit and we'll send a gated, revocable demo link.
Yes. RSE licensees (super trustees) are APRA-regulated and must meet CPS 230 from 1 July 2026, with particular focus on service provider oversight given heavy outsourcing.
Material service provider oversight — administration, custody and investment providers must be in the register with evidenced contract clauses and fourth-party transparency.
Yes. Trustees assess CPS 234 information security and CPS 230 resilience from one evidence base, reusing shared controls.