Strengthening Operational Resilience and Security for APRA CPS 230 and CPS 234 Thomas Ferguson (Senior Sales Engineer)

For Australian financial institutions, meeting APRA expectations now means proving resilience in a world of cloud services, third-party dependencies and persistent cyber threats, as well as satisfying compliance requirements. Prudential Standards CPS 230 and CPS 234 raise the bar for both operational continuity and information security, pushing organisations to modernise how they protect critical services, data and users.The timelines make the point. CPS 234 has been in force since July 2019. CPS 230 has applied since 1 July 2025, and the transition period for pre-existing service provider arrangements ended on 1 July 2026. Both standards are now fully in effect, and for most institutions the question has moved from how the framework is designed to whether the evidence holds up.What we are hearing from financial institutions is that the regulatory burden goes well beyond adding more controls. The challenge is proving resilience across a much more complex operating environment. With growing dependence on cloud services, third parties and distributed users, many teams are finding that traditional approaches make it harder to meet rising regulatory expectations efficiently. Understanding the MandatesWhile CPS 230 and CPS 234 address different areas, together they reinforce a common expectation: financial institutions must be able to protect critical assets and continue operating during disruption.CPS 230: Operational Risk ManagementFocuses on resilience, business continuity and third-party risk. Institutions must identify critical operations, define disruption tolerances and maintain service continuity during severe events. APRA names the operations it expects to be treated as critical at a minimum: payments, deposit-taking, custody, settlements and clearing for banks; claims processing for insurers; investment management and fund administration for superannuation trustees. Each needs Board-approved tolerance levels, a credible business continuity plan tested against severe but plausible scenarios, and a register of material service providers. A material operational risk incident must be notified to APRA within 72 hours, and a disruption to a critical operation outside tolerance within 24 hours.CPS 234: Information SecurityFocuses on safeguarding information assets through effective security controls, testing, governance and incident response. The Board is ultimately responsible for information security, controls must be proportionate to the sensitivity and criticality of each asset, and their effectiveness must be tested systematically. Material incidents must be notified to APRA within 72 hours, and material control weaknesses that cannot be remediated promptly within 10 business days. An incident reported under CPS 234 does not need to be reported again under CPS 230. How Zscaler Helps Regulated Entities ComplyTo support these security and resilience mandates, the Zscaler Zero Trust Exchange™ provides a cloud-native architecture that eliminates implicit trust. Operating as a globally distributed service, it enforces strict, identity-based, least-privilege access and performs continuous inline inspection across the internet, SaaS and private applications.Because every connection is brokered and inspected, every policy decision is also logged: who accessed what, which threat was blocked, which configuration changed. That telemetry, exported to your SIEM or GRC platform, is the evidence base that both standards, and your auditors, ask for.Governance, risk appetite and regulatory reporting remain the responsibility of the regulated entity. Zscaler provides the architectural enforcement and technical controls that support APRA-regulated entities in meeting their obligations.How Zscaler Supports CPS 230Improve resilience without relying on legacy infrastructureBy removing dependence on centralised VPNs and traditional perimeter controls, Zscaler helps reduce single points of failure and supports more resilient access to critical applications. In a hub-and-spoke design, one failed concentrator or one compromised branch can become a disruption to payments or claims processing. Connecting users directly to the applications they are authorised to use removes that path.Maintain access during disruptionCapabilities such as Business Continuity Cloud, part of Zscaler Resilience, help organisations preserve secure user access during major outages or disruptive events. It provides a customer-specific backup instance, isolated from the primary cloud, that maintains equivalent security policy during failover rather than bypassing controls to restore connectivity. Private Service Edge offers a local on-ramp, and disaster recovery mode lets Zscaler Client Connector fall back to pre-defined emergency policies. Our Resilience Audit helps teams rehearse failover against their own recovery time objectives, which supports the testing CPS 230 requires, including scenarios where a material service provider fails.Improve visibility across third-party servicesWith Zscaler Digital Experience (ZDX), teams can monitor the digital experience across users, SaaS platforms and service providers, helping support oversight of critical external dependencies. When a disruption occurs, ZDX shows whether it originated in your own environment, with an ISP or with a SaaS provider. That is the kind of evidence CPS 230 expects when you monitor material service providers against agreed service levels.Support local enforcement and data handling requirementsZscaler’s presence in Australia helps organisations align security enforcement more closely with local operational and data handling expectations. CPS 230 requires entities to assess the risks of geographic location and to notify APRA before entering a material offshoring arrangement, so knowing where traffic is processed and where logs are held is part of the assessment.Support your due diligence on Zscaler itselfCPS 230 treats providers of risk management and core technology services as material unless the entity can justify otherwise, so a security platform that supports critical operations is likely to appear on your register. We built the CPS 230 guide on that assumption. To support your assessment, Zscaler provides independent assurance, including IRAP assessment at the PROTECTED level, SOC 2 Type II and ISO/IEC 27001, through the Zscaler Compliance Center; live availability and performance data on the Zscaler Trust Portal; contractual SLAs; and open standards such as SAML, SCIM, IPsec and GRE that support an orderly exit if one is ever needed.How Zscaler Supports CPS 234Reduce attack surface and limit lateral movementZscaler connects users directly to approved applications rather than placing them on the corporate network, helping reduce exposure and contain compromise. With Zscaler Private Access (ZPA), private applications are not reachable from the internet, so there is nothing for an attacker to scan, and a compromised account reaches only the applications that user was entitled to.Inspect traffic and stop threats inlineInline inspection and advanced threat protection help identify malicious activity before it reaches users or sensitive environments. Zscaler Internet Access (ZIA) inspects internet and SaaS traffic, including encrypted traffic, with cloud firewall, intrusion prevention, DNS security and sandboxing applied in a single pass.Protect sensitive data wherever it movesDLP and CASB capabilities help organisations discover, classify and protect sensitive information across web, SaaS and private application traffic. Exact data match, file fingerprinting and optical character recognition let you apply controls proportionate to the sensitivity of each information asset, which is what CPS 234 asks of control design.Strengthen control consistency in hybrid environmentsZscaler applies policy more consistently across branch offices, remote users, cloud workloads and third-party access models. One policy, enforced everywhere and logged on every transaction, also gives you continuous evidence of control effectiveness, far more than a point-in-time sample, which supports the systematic testing CPS 234 requires. The Next Test: Extending the Same Principles to AIWhat we are seeing is Boards shifting the question from “are we secure?” to “can we keep delivering critical operations when something we depend on fails?” APRA’s April 2026 letter on artificial intelligence raises that bar again. AI agents, AI built into supplier platforms and staff using unapproved AI tools bring new identities, new data flows and new fourth-party dependencies. APRA has said it expects enforceable preventative controls and continuous assurance, and that policy direction and after-the-fact detection on their own fall short.The Zero Trust principles that underpin CPS 230 and CPS 234 now have to extend to AI: verify every identity, human or machine, and inspect every flow. Institutions that treat these standards as the foundation for governing AI will be best placed to adopt it with confidence. Those that treat them as a finished compliance exercise will be revisiting the same gaps under a new heading. What Remains With the Regulated EntityZscaler provides technical controls, telemetry and architecture. Risk appetite, the designation of critical operations, tolerance levels, Board approvals, materiality decisions and notifications to APRA stay with the institution. Nothing Zscaler provides replaces your own legal, regulatory or prudential assessment. Simplify Your Compliance JourneyNavigating APRA’s requirements is a continuous journey, and it calls for a unified approach to security and resilience that serves both standards at once. The Zscaler Zero Trust Exchange gives financial institutions a technical foundation that supports both CPS 230 and CPS 234 while allowing them to adopt cloud services with confidence.To support that work, we have developed a control mapping guide for each standard, and a third for APRA’s AI expectations. They work through the requirements one by one, separating what the entity owns from how Zscaler capabilities align, and are written to support control design and evidence discussions with your risk, audit and security teams.Download the CPS 230 Control Mapping Guide Download the CPS 234 Control Mapping GuideDownload the APRA AI Supervisory Expectations Mapping GuideTo discuss how these map to your own critical operations and tolerance levels, contact your Zscaler team.  

​[#item_full_content] For Australian financial institutions, meeting APRA expectations now means proving resilience in a world of cloud services, third-party dependencies and persistent cyber threats, as well as satisfying compliance requirements. Prudential Standards CPS 230 and CPS 234 raise the bar for both operational continuity and information security, pushing organisations to modernise how they protect critical services, data and users.The timelines make the point. CPS 234 has been in force since July 2019. CPS 230 has applied since 1 July 2025, and the transition period for pre-existing service provider arrangements ended on 1 July 2026. Both standards are now fully in effect, and for most institutions the question has moved from how the framework is designed to whether the evidence holds up.What we are hearing from financial institutions is that the regulatory burden goes well beyond adding more controls. The challenge is proving resilience across a much more complex operating environment. With growing dependence on cloud services, third parties and distributed users, many teams are finding that traditional approaches make it harder to meet rising regulatory expectations efficiently. Understanding the MandatesWhile CPS 230 and CPS 234 address different areas, together they reinforce a common expectation: financial institutions must be able to protect critical assets and continue operating during disruption.CPS 230: Operational Risk ManagementFocuses on resilience, business continuity and third-party risk. Institutions must identify critical operations, define disruption tolerances and maintain service continuity during severe events. APRA names the operations it expects to be treated as critical at a minimum: payments, deposit-taking, custody, settlements and clearing for banks; claims processing for insurers; investment management and fund administration for superannuation trustees. Each needs Board-approved tolerance levels, a credible business continuity plan tested against severe but plausible scenarios, and a register of material service providers. A material operational risk incident must be notified to APRA within 72 hours, and a disruption to a critical operation outside tolerance within 24 hours.CPS 234: Information SecurityFocuses on safeguarding information assets through effective security controls, testing, governance and incident response. The Board is ultimately responsible for information security, controls must be proportionate to the sensitivity and criticality of each asset, and their effectiveness must be tested systematically. Material incidents must be notified to APRA within 72 hours, and material control weaknesses that cannot be remediated promptly within 10 business days. An incident reported under CPS 234 does not need to be reported again under CPS 230. How Zscaler Helps Regulated Entities ComplyTo support these security and resilience mandates, the Zscaler Zero Trust Exchange™ provides a cloud-native architecture that eliminates implicit trust. Operating as a globally distributed service, it enforces strict, identity-based, least-privilege access and performs continuous inline inspection across the internet, SaaS and private applications.Because every connection is brokered and inspected, every policy decision is also logged: who accessed what, which threat was blocked, which configuration changed. That telemetry, exported to your SIEM or GRC platform, is the evidence base that both standards, and your auditors, ask for.Governance, risk appetite and regulatory reporting remain the responsibility of the regulated entity. Zscaler provides the architectural enforcement and technical controls that support APRA-regulated entities in meeting their obligations.How Zscaler Supports CPS 230Improve resilience without relying on legacy infrastructureBy removing dependence on centralised VPNs and traditional perimeter controls, Zscaler helps reduce single points of failure and supports more resilient access to critical applications. In a hub-and-spoke design, one failed concentrator or one compromised branch can become a disruption to payments or claims processing. Connecting users directly to the applications they are authorised to use removes that path.Maintain access during disruptionCapabilities such as Business Continuity Cloud, part of Zscaler Resilience, help organisations preserve secure user access during major outages or disruptive events. It provides a customer-specific backup instance, isolated from the primary cloud, that maintains equivalent security policy during failover rather than bypassing controls to restore connectivity. Private Service Edge offers a local on-ramp, and disaster recovery mode lets Zscaler Client Connector fall back to pre-defined emergency policies. Our Resilience Audit helps teams rehearse failover against their own recovery time objectives, which supports the testing CPS 230 requires, including scenarios where a material service provider fails.Improve visibility across third-party servicesWith Zscaler Digital Experience (ZDX), teams can monitor the digital experience across users, SaaS platforms and service providers, helping support oversight of critical external dependencies. When a disruption occurs, ZDX shows whether it originated in your own environment, with an ISP or with a SaaS provider. That is the kind of evidence CPS 230 expects when you monitor material service providers against agreed service levels.Support local enforcement and data handling requirementsZscaler’s presence in Australia helps organisations align security enforcement more closely with local operational and data handling expectations. CPS 230 requires entities to assess the risks of geographic location and to notify APRA before entering a material offshoring arrangement, so knowing where traffic is processed and where logs are held is part of the assessment.Support your due diligence on Zscaler itselfCPS 230 treats providers of risk management and core technology services as material unless the entity can justify otherwise, so a security platform that supports critical operations is likely to appear on your register. We built the CPS 230 guide on that assumption. To support your assessment, Zscaler provides independent assurance, including IRAP assessment at the PROTECTED level, SOC 2 Type II and ISO/IEC 27001, through the Zscaler Compliance Center; live availability and performance data on the Zscaler Trust Portal; contractual SLAs; and open standards such as SAML, SCIM, IPsec and GRE that support an orderly exit if one is ever needed.How Zscaler Supports CPS 234Reduce attack surface and limit lateral movementZscaler connects users directly to approved applications rather than placing them on the corporate network, helping reduce exposure and contain compromise. With Zscaler Private Access (ZPA), private applications are not reachable from the internet, so there is nothing for an attacker to scan, and a compromised account reaches only the applications that user was entitled to.Inspect traffic and stop threats inlineInline inspection and advanced threat protection help identify malicious activity before it reaches users or sensitive environments. Zscaler Internet Access (ZIA) inspects internet and SaaS traffic, including encrypted traffic, with cloud firewall, intrusion prevention, DNS security and sandboxing applied in a single pass.Protect sensitive data wherever it movesDLP and CASB capabilities help organisations discover, classify and protect sensitive information across web, SaaS and private application traffic. Exact data match, file fingerprinting and optical character recognition let you apply controls proportionate to the sensitivity of each information asset, which is what CPS 234 asks of control design.Strengthen control consistency in hybrid environmentsZscaler applies policy more consistently across branch offices, remote users, cloud workloads and third-party access models. One policy, enforced everywhere and logged on every transaction, also gives you continuous evidence of control effectiveness, far more than a point-in-time sample, which supports the systematic testing CPS 234 requires. The Next Test: Extending the Same Principles to AIWhat we are seeing is Boards shifting the question from “are we secure?” to “can we keep delivering critical operations when something we depend on fails?” APRA’s April 2026 letter on artificial intelligence raises that bar again. AI agents, AI built into supplier platforms and staff using unapproved AI tools bring new identities, new data flows and new fourth-party dependencies. APRA has said it expects enforceable preventative controls and continuous assurance, and that policy direction and after-the-fact detection on their own fall short.The Zero Trust principles that underpin CPS 230 and CPS 234 now have to extend to AI: verify every identity, human or machine, and inspect every flow. Institutions that treat these standards as the foundation for governing AI will be best placed to adopt it with confidence. Those that treat them as a finished compliance exercise will be revisiting the same gaps under a new heading. What Remains With the Regulated EntityZscaler provides technical controls, telemetry and architecture. Risk appetite, the designation of critical operations, tolerance levels, Board approvals, materiality decisions and notifications to APRA stay with the institution. Nothing Zscaler provides replaces your own legal, regulatory or prudential assessment. Simplify Your Compliance JourneyNavigating APRA’s requirements is a continuous journey, and it calls for a unified approach to security and resilience that serves both standards at once. The Zscaler Zero Trust Exchange gives financial institutions a technical foundation that supports both CPS 230 and CPS 234 while allowing them to adopt cloud services with confidence.To support that work, we have developed a control mapping guide for each standard, and a third for APRA’s AI expectations. They work through the requirements one by one, separating what the entity owns from how Zscaler capabilities align, and are written to support control design and evidence discussions with your risk, audit and security teams.Download the CPS 230 Control Mapping Guide Download the CPS 234 Control Mapping GuideDownload the APRA AI Supervisory Expectations Mapping GuideTo discuss how these map to your own critical operations and tolerance levels, contact your Zscaler team.