Compliance · APRA CPS 234
APRA CPS 234 training, phishing simulation and evidence, for Australian regulated entities.
Vigil supports the personnel and capability expectations of CPS 234, phishing simulation, role-based training for finance, claims and admin functions, and the time-stamped evidence pack your APRA assessor (and your FAR accountable person) can self-serve.
What is APRA CPS 234?
CPS 234 is APRA's Information Security prudential standard. It requires regulated entities to maintain an information security capability commensurate with the size and extent of threats to their information assets, and to enable the continued sound operation of the entity. It came into effect 1 July 2019 and now sits alongside CPS 230 (Operational Risk Management) and the Financial Accountability Regime (FAR).
CPS 234 itself does not contain a standalone staff-training clause. It sets roles (paragraphs 13-14), an information security policy framework (paragraph 19), capability (paragraph 21), and systematic testing of control effectiveness (paragraphs 27-31). APRA's awareness-training guidance sits in CPG 234, the accompanying guidance rather than the enforceable standard. In practice, awareness training, phishing simulation and continuous evidence are how most entities show that human-layer capability is operating, not just documented.
How Vigil maps to CPS 234
| CPS 234 expectation | What it asks for | How Vigil supports it |
|---|---|---|
| Paras 13-14, roles & responsibilities | Clearly defined information-security roles across the Board, management and personnel. | Role-based training tracks (finance, claims, admin, executive) so personnel understand their responsibilities. |
| Para 19, policy framework | Maintain an information security policy framework. | Policy-attestation module plus just-in-time reminders that evidence staff have read and understood policy. |
| Para 21, capability | Information-security capability commensurate with threats. | AI-era phishing, vishing and deepfake-style simulations tuned to current threats (any cloned voice or likeness only ever made with consent). |
| Paras 27-31, testing | Systematic testing of control effectiveness. | Quarterly phishing campaigns and multi-channel coordinated tests, with trended results. |
| CPG 234, training guidance | Awareness-training guidance (guidance, not the standard). | Role-based awareness training and a per-employee completion register. |
| FAR alignment | Personal accountability for cyber-resilience outcomes. | Accountable-person attestations plus board-level dashboard. |
CPS 234 + CPS 230, what changed in 2025
CPS 230 (operational risk) came into force on 1 July 2025. It focuses on operational risk management, including third-party and service-provider arrangements, and reinforces personal accountability under FAR. CPS 230 does not mandate awareness training, but a credible operational-risk posture generally includes staff awareness of third-party and payment risks. Vigil supplies that human-layer awareness signal and the accountable-person attestation flow; your ISMS and operational-risk framework own the rest.
CPS 234 + Vigil, common questions
Is CPS 234 mandatory for my organisation?
CPS 234 applies to all APRA-regulated entities, banks, insurers, superannuation trustees, RSE licensees and their subsidiaries. If you hold an APRA licence, CPS 234 applies. The standard came into force 1 July 2019. CPS 230 (operational risk) took effect 1 July 2025 and sits alongside it.
Does CPS 234 require security awareness training?
Not explicitly. CPS 234 itself contains no standalone staff-training clause. It sets information-security roles (paragraphs 13-14), an information security policy framework (paragraph 19), capability commensurate with threats (paragraph 21), and systematic testing of control effectiveness (paragraphs 27-31). APRA's awareness-training guidance sits in CPG 234, the accompanying guidance rather than the standard. In practice, awareness training and phishing simulation are how most entities evidence the capability, policy and testing expectations against human-layer threats such as phishing.
How does Vigil's evidence pack help with CPS 234?
Vigil produces a date-stamped, per-employee training register, phishing campaign results segmented by role, and a continuous-control timeline that shows the programme is running, not just designed. APRA's self-assessment work looks for evidence that controls are operating effectively, and Vigil's pack maps to that human-layer ask.
What about CPS 230 (operational risk), does it change anything?
CPS 230 (effective 1 July 2025) focuses on operational risk management, including service-provider arrangements, and reinforces personal accountability under the Financial Accountability Regime (FAR). It does not mandate awareness training, but a credible operational-risk posture generally includes staff awareness of third-party and payment risks. Vigil supplies that human-layer signal and the accountable-person attestation flow; your ISMS and operational-risk framework own the rest.
Can I share Vigil evidence with my APRA assessor?
Yes. The Vigil auditor portal provides read-only, time-boxed access so an APRA-aligned assessor can self-serve the underlying simulation, training and remediation records without your team exporting CSVs.
Does Vigil support the more intensive expectations on larger institutions?
Yes. Vigil's role-based training and BEC / payment-fraud simulations align with the more intensive expectations APRA places on larger, systemically important institutions. The dashboard's continuous risk-score timeline supports the ongoing testing expectations in CPS 234 (paragraphs 27-31).
Walk into your APRA review with the evidence already done.
14-day free trial. No credit card. CPS 234-aligned evidence pack on day 1.