CPS 234 Penetration Testing: What APRA-Regulated Entities and Their Suppliers Need to Know

CPS 234 doesn't use the words "annual penetration test", but it does require every APRA-regulated bank, insurer, health insurer and super trustee to test the effectiveness of its information security controls through a systematic testing program, run by appropriately skilled and functionally independent specialists. In practice, independent penetration testing is one of the main ways entities meet that requirement, and APRA's own guidance lists it as a testing technique. If you supply software, cloud hosting or managed IT to an APRA-regulated entity, those obligations flow down to you through due diligence questionnaires, contracts and requests for evidence.

This guide explains what CPS 234 actually says about testing, how penetration testing fits, what APRA found when it audited entities against the standard, what suppliers should expect, and what a CPS 234-ready test costs on published Aussie Pentest tiers. It pairs with our guides on how often to get a penetration test, cloud penetration testing and what a pentest report should include.

What is CPS 234?

CPS 234 Information Security is a binding prudential standard from the Australian Prudential Regulation Authority (APRA) that has applied since 1 July 2019. It requires regulated entities to keep an information security capability that matches the threats they face, protect their information assets with proportionate controls, test those controls systematically, and notify APRA of material incidents.

It applies to:

• ▸authorised deposit-taking institutions (banks, credit unions and building societies), including foreign ADIs for their Australian branch operations;
• ▸general insurers, life insurers and friendly societies;
• ▸private health insurers; and
• ▸RSE licensees (superannuation trustees).

The Board of the regulated entity is ultimately responsible for information security under the standard. That matters for testing, because the Board needs credible evidence that controls work, not just a policy saying they should.

The supporting guide: CPG 234

APRA also publishes Prudential Practice Guide CPG 234. It is not binding, but it explains how APRA expects entities to meet CPS 234. Most of the practical detail on testing frequency, scope and independence lives in CPG 234 rather than the standard itself.

Does CPS 234 require penetration testing?

Not by name, but it requires systematic control testing by independent specialists, and penetration testing is one of the testing techniques APRA's guidance explicitly lists. For most entities with internet-facing systems, customer portals or cloud workloads, it would be hard to show a credible testing program without it.

Paragraphs 27 to 31 of CPS 234 set out the testing requirements:

1. Systematic testing program (paragraph 27). The entity must test the effectiveness of its information security controls through a systematic program. The nature and frequency of testing must match how fast threats and vulnerabilities change, the criticality and sensitivity of the asset, the consequences of an incident, exposure to environments the entity can't control, and how often the asset changes.
2. Third-party reliance (paragraph 28). Where a related party or third party manages information assets and the entity relies on that party's testing, the entity must assess whether that testing meets the same bar.
3. Escalation (paragraph 29). Testing results showing deficiencies that can't be fixed in a timely manner must be escalated to the Board or senior management.
4. Independent specialists (paragraph 30). Testing must be done by appropriately skilled and functionally independent specialists.
5. Annual review (paragraph 31). The entity must review the sufficiency of the testing program at least annually, or when there is a material change to information assets or the business environment.

What CPG 234 adds

CPG 234's testing section and its Attachment G fill in the detail:

• ▸At least annually. APRA's view is that a sufficient set of controls should be tested at least annually to confirm they remain effective.
• ▸More often for exposed assets. Controls protecting assets exposed to "untrusted" environments, which CPG 234 defines to include internet exposure and connections to service providers and customers, would typically be tested throughout the year.
• ▸A range of techniques. Attachment G maps control objectives to testing techniques, including penetration tests for network protection controls, penetration tests "including more advanced techniques commonly referred to as red team tests" for detection controls, and penetration tests alongside code review and scanning for secure software development.
• ▸Clear success criteria. Tests should have defined success criteria, including when re-testing is required, with results reported and follow-up actions formally tracked.

So the honest answer is: CPS 234 sets an outcome (credible, independent, risk-based assurance), and penetration testing is a core tool for delivering it.

What did APRA find when it audited CPS 234 compliance?

APRA's first tranche of independent CPS 234 assessments found that control testing programs were often incomplete, inconsistent and lacked independence. It was one of six common gaps.

In July 2023, APRA reported early results from its CPS 234 tripartite assessments, which required regulated entities to appoint an independent auditor. More than 300 banks, insurers and super trustees were due to take part by the end of 2023, and around 24% of regulated entities were covered in the first tranche. The most common gaps were:

1. incomplete identification and classification of critical and sensitive information assets;
2. limited assessment of third-party information security capability;
3. inadequate definition and execution of control testing programs;
4. incident response plans not regularly reviewed or tested;
5. limited internal audit review of information security controls; and
6. inconsistent and untimely reporting of material incidents and control weaknesses to APRA.

On testing specifically, APRA said many programs "are incomplete, inconsistent, lack independence and do not provide adequate assurance for management and the Board." The detailed gaps included testing not done by functionally independent testers, inconsistent procedures and success criteria, and evidence not being retained.

On third parties, APRA found that control effectiveness was often based on the supplier's self-assessment alone, "without verification through additional independent testing."

Why this matters for suppliers

That second finding is the one SaaS vendors, MSPs and cloud hosting providers feel. When a bank, insurer or super fund tightens third-party assurance, it asks its suppliers for evidence: recent independent test reports, remediation status and retest results. A filled-in questionnaire with no testing behind it is exactly what APRA criticised.

Does CPS 234 apply to suppliers and service providers?

CPS 234 binds the APRA-regulated entity, not the supplier, but the entity must assess its suppliers' information security capability and evaluate the design of their controls, so the requirements reach you through contracts and due diligence.

The standard says that where information assets are managed by a related party or third party, the regulated entity must:

• ▸assess that party's information security capability, commensurate with the potential consequences of an incident (paragraph 16);
• ▸evaluate the design of the party's controls protecting the entity's information assets (paragraph 22);
• ▸assess whether testing it relies on is adequate (paragraph 28); and
• ▸have internal audit assess third-party assurance where an incident could materially affect the entity and internal audit intends to rely on that assurance (paragraph 34).

APRA's footnotes make clear these apply to all information assets managed by related and third parties, not only formal outsourcing arrangements.

CPS 230 raises the stakes

CPS 230 Operational Risk Management came into force on 1 July 2025. It requires APRA-regulated entities to identify and manage risks from material service providers, and APRA now asks entities to provide a list of their most material service providers. If you are on that list, expect closer scrutiny of how your systems are tested and how quickly you fix what's found.

What suppliers are commonly asked for

Requests from banks, insurers and super funds to their suppliers commonly include:

• ▸an independent penetration test report from the last 12 months covering the systems that hold or process the client's data;
• ▸evidence that critical and high findings were remediated, ideally confirmed by a retest;
• ▸the tester's independence and qualifications;
• ▸scope details (which environments, which applications, authenticated or not); and
• ▸a commitment to test after major changes.

What should a CPS 234-aligned penetration test cover?

A CPS 234-aligned test should be scoped around your critical and sensitive information assets and the paths an attacker could use to reach them, with priority on anything exposed to untrusted environments. Coverage should follow the asset classification, not the cheapest scope.

Typical scope for regulated entities and their suppliers

• ▸External network and perimeter. Internet-facing hosts, remote access, VPNs and exposed services.
• ▸Web applications and customer portals. Authentication, session handling, authorisation between customers, and data exposure.
• ▸APIs and integrations. Especially those connecting to partners, brokers, payment systems or member platforms. See our guide to API penetration testing.
• ▸Cloud and Microsoft 365. Identity, privileged roles, storage exposure and tenant configuration.
• ▸Internal network (assumed breach). What an attacker with a foothold, or a compromised supplier account, could reach. See external vs internal penetration testing.
• ▸Detection testing. Whether testing activity was noticed and escalated, which supports CPG 234's detection control objective.
• ▸Social engineering, where in scope. Phishing or pretexting to test staff-facing controls.

Choose the right starting point

A black-box test shows what an outsider can do with no knowledge. A grey-box or white-box test, with credentials and documentation, gets deeper coverage of the controls that matter in the time available. For CPS 234 assurance, grey-box is usually the better use of budget. Our guide to black box vs grey box vs white box testing explains the trade-offs.

How often should APRA-regulated entities run penetration tests?

At least annually for the controls that matter, more often for internet-facing and third-party-connected assets, and after any material change. That follows directly from CPS 234 paragraph 27 and CPG 234's guidance on untrusted environments.

A practical starting cadence:

Treat this as a starting point, not a rule. Your testing program should be justified by your own asset classification and threat picture, and reviewed at least annually as CPS 234 paragraph 31 requires.

What makes a tester "functionally independent"?

Functionally independent means the people testing a control don't have operational responsibility for it. CPG 234 says testers should be sufficiently independent to give a bias-free assessment, unimpeded by a conflict of interest, and that the level of independence required depends on the nature and importance of the testing.

That has practical consequences:

• ▸Your MSP testing its own work is a weak fit. If the provider that built and runs your environment also tests it, independence is hard to argue. An external tester validates what the MSP built rather than replacing it.
• ▸Internal teams can test some controls, as long as they're separate from the teams operating them. For high-importance testing, an external specialist is usually easier to defend.
• ▸Skills matter as much as independence. CPS 234 requires "appropriately skilled" specialists, so ask about the tester's experience and methodology, not just their logo.

What should a CPS 234 penetration test report include?

The report should give the Board and auditors evidence they can rely on: clear scope, risk-rated findings with proof, remediation guidance and a record of what was retested. APRA's audit findings specifically called out testing evidence that wasn't retained, so the report itself is part of your compliance record.

Look for:

• ▸an executive summary written for senior management and the Board;
• ▸the exact scope, dates, testing approach and any limitations;
• ▸each finding with a severity rating, affected assets, proof-of-concept evidence and business impact;
• ▸prioritised remediation steps your team or MSP can act on;
• ▸clear identification of anything that may count as a material control weakness; and
• ▸retest results showing which findings are closed.

That last point connects to the notification rules. Under CPS 234 paragraph 36, an entity must notify APRA within 10 business days of becoming aware of a material information security control weakness it expects it won't be able to remediate in a timely manner. Paragraph 35 separately requires notification within 72 hours of certain material information security incidents. Test results feed directly into those decisions, so findings need to be clear enough for the entity to make them.

What remediation validation looks like in practice

Our pricing page includes a financial services example: an internal black-box penetration test of Azure-hosted Windows server infrastructure using only built-in Windows tooling. It identified 10 findings across two hosts, including factory-default credentials on a live security monitoring platform, a legacy remote access protocol sending credentials in cleartext, and no account lockout policy. Four days after delivery, a structured validation session confirmed documented evidence of fixes for 8 of the 10 findings and a clear plan for the remaining 2. That is the kind of tracked follow-up CPG 234 describes.

How much does a CPS 234 penetration test cost in Australia?

Aussie Pentest doesn't sell a separate "CPS 234 package"; regulated entities and their suppliers are scoped into fixed-fee, human-led penetration tests starting from $5,000, $12,000 or $20,000 + GST, depending on what's in scope. The final price is fixed in writing after a scoping call.

Published penetration testing tiers are delivered in 5 to 10 business days. Prices are from our live pricing page.

What changes the price

• ▸the number of applications, APIs, IP addresses and cloud environments in scope;
• ▸whether testing is authenticated and how many user roles need testing;
• ▸whether internal or assumed-breach testing is included;
• ▸social engineering or detection testing; and
• ▸retesting requirements and reporting formats your client or auditor needs.

How should you prepare for a CPS 234-driven test?

Start from your asset classification, agree success criteria up front, and make sure the right people will act on the results. A few steps make a big difference:

1. Map the critical and sensitive assets in scope, including those held by suppliers.
2. Confirm who owns each control so findings land with someone who can fix them.
3. Agree success criteria and retest triggers before testing starts.
4. Check third-party permissions for cloud, hosting and SaaS platforms.
5. Plan the Board or client report so the executive summary answers their questions.
6. Book the retest when you book the test.

Our pentest preparation checklist covers the logistics in more detail.

Frequently asked questions

Is penetration testing mandatory under CPS 234?

Not by name. CPS 234 requires a systematic, independent control testing program, and CPG 234 lists penetration testing among the expected techniques. For internet-facing systems, it is one of the most direct ways to meet the requirement.

Does CPS 234 apply to my business if I'm not APRA-regulated?

Not directly. But if you manage information assets for a bank, insurer, health insurer or super trustee, that entity must assess your security capability and testing. Expect contractual requirements and requests for independent test evidence.

How often does CPS 234 require testing?

The standard ties frequency to risk, change and exposure. CPG 234 says a sufficient set of controls should be tested at least annually, with assets exposed to untrusted environments typically tested throughout the year.

Can our internal IT team or MSP do the testing?

Only if they are functionally independent of the controls being tested. Teams or providers that operate the environment generally can't give a bias-free assessment, which is why many entities use external specialists.

Is an Essential Eight assessment enough for CPS 234?

No single assessment covers CPS 234. An Essential Eight assessment measures maturity against eight mitigation strategies; a penetration test shows whether an attacker can actually get through. Many organisations use both as part of a wider testing program.

The bottom line

CPS 234 asks APRA-regulated entities to prove their security controls work, through systematic, risk-based testing by skilled and independent specialists, and APRA's own audits show many programs fall short. Penetration testing is one of the most direct ways to produce that evidence, especially for internet-facing systems and third-party connections. If you supply a bank, insurer or super fund, assume you'll be asked for a recent independent test report and proof that critical findings were fixed.

Need a test your Board, auditor or financial services client will accept? Explore our penetration testing services, see how a vCISO retainer can run your testing program year-round, or book a 1-on-1 scoping call with the Aussie Pentest team.

Sources

• ▸APRA: CPS 234 Information Security
• ▸APRA: CPG 234 Information Security (Prudential Practice Guide)
• ▸APRA: CPG 234 Information Security, June 2019 (PDF)
• ▸APRA: Cyber security stocktake exposes gaps (5 July 2023)
• ▸APRA: New prudential standard on operational risk management comes into force (1 July 2025)
• ▸Aussie Pentest: Pricing

This article is general information only, not legal, regulatory or compliance advice. Regulatory references are current as of October 2026. Check your own obligations with a qualified adviser.