APRA CPS 234 evidence, collected continuously
CPS 234 requires an information security capability “commensurate with the size and extent of threats” to your information assets — and the ability to show it. Attest collects technical control evidence automatically from your systems, records board and approver attestations alongside it, and produces reports your internal audit, external auditors and board can trace back to the underlying evidence.
What CPS 234 requires, and what Attest can evidence
Paragraph numbers below are from Prudential Standard CPS 234 as published by APRA. The standard has 36 paragraphs. Attest provides clear separation between automated technical controls and documentary governance evidence. To see how these requirements align with your baseline defences, explore our Essential Eight coverage or read the full APRA CPS 234 Evidence Guide.
| CPS 234 Area & Paragraphs | Evidence Type | How Attest Helps |
|---|---|---|
Roles and responsibilities Paragraphs 13–14 | Governance Board minutes, defined roles, governance approvals | Approver attestations and risk acceptances recorded as signature events in the evidence ledger with immutable timestamps. |
Information security capability Paragraphs 15–17 | Technical Control Continuous infrastructure and endpoint telemetry | Automated collection from connected systems commensurate with the size and extent of threats to information assets. |
Policy framework Paragraphs 18–19 | Documentary Information security policies, annual reviews | Recorded through governance attestation and policy version hashing; otherwise reported objectively as UNKNOWN. |
Asset identification & classification Paragraphs 20 | Documentary Information asset register, criticality ratings | Maintained via governance attestation with tenant asset boundaries; unmapped assets remain flagged as UNKNOWN. |
Implementation of controls Paragraphs 21–22 | Configuration & Telemetry MFA, patch currency, EDR, access controls | Automated technical evidence collected from connectors; third-party service provider controls captured via governance evidence. |
Incident management Paragraphs 23–26 | Detection & Response Response plans, annual testing, detection logs | EDR health, detection telemetry, and audit logs serve as supporting technical evidence; response plans confirmed via attestation. |
Testing control effectiveness Paragraphs 27–31 | Assurance & Testing Vulnerability scans, penetration test reports | Vulnerability scan ingestion and continuous control-state evidence support, but do not replace, the formal independent testing program. |
Internal audit Paragraphs 32–34 | Audit Evidence Independent internal audit reviews and findings | Reports structured with cryptographic evidence appendices, SHA-256 hashes, and chain-of-custody statements for auditors to verify. |
APRA notification Paragraphs 35–36 | Notification History 72-hour incident and 10-day weakness logs | Timestamped, immutable audit logs and historical evidence records support the regulated entity’s formal notification records. |
Technical evidence vs governance evidence
Attest is explicit about the difference. Technical controls — MFA, patch levels, endpoint protection, backup status, access management, encryption settings, cloud posture — are collected automatically. Requirements that depend on policies, board minutes, asset registers, training records or testing programs are shown as UNKNOWN until they are supported by governance evidence or an attestation. Attest never infers a pass from missing documentation.
Automated Technical Controls
Continuous, tenant-bound collection directly from authentic telemetry connectors. Gaps are captured immediately as evidence.
- MFA enforcement across identities
- Endpoint protection and EDR health
- Operating system and application patch states
- Backup execution and restore-test signals
- Cloud infrastructure security configurations
Governance & Attestation Records
Requirements depending on human judgment, policy reviews, or external assurance are signed cryptographically into the ledger.
- Board and executive role attestations
- Information security policy approvals
- Information asset register sign-offs
- Independent testing program attestations
- Material third-party assurance evaluations
Hosting, encryption and sovereign controls
Architectural specifications engineered for regulated Australian financial entities, APRA compliance, and statutory assurance.
AWS Sydney
Production hosting located exclusively in AWS Sydney (ap-southeast-2). No evidence replication outside the approved Australian deployment boundary.
S3 Object Lock
Evidence objects are committed to S3 Object Lock in Compliance mode. Records cannot be deleted, modified, or overwritten by any party during retention.
AES-256 & TLS 1.3
Encryption at rest via AWS KMS (AES-256) and strict TLS 1.3 in transit. Evidence packets are hashed with SHA-256 and chained into per-tenant ledgers.
Customer Keys
Customer-managed encryption keys for entitled Enterprise, Sovereign and Government / Bank deployments (from A$25,000 a year as an add-on).
Where to start: APRA CPS 234 outcome packs
The APRA CPS 234 Evidence outcome pack is available across our Professional and Enterprise tiers.
Attest Professional
Full APRA CPS 234 evidence mapping with up to 12 verified reports per year and multi-cloud telemetry connectors.
- 36-paragraph CPS 234 mapping and RAG scorecard
- Immutable WORM storage in AWS Sydney
- QR code and API endpoint report verification
- Also available via Assurance Suite (from A$3,999/mo)
Enterprise & Sovereign
Dedicated tenancy, legal hold and chain-of-custody export where contracted, SAML / SCIM, and customer KMS keys.
- 24+ compliance reports per year with custom cadence
- Customer-managed encryption keys (BYOK add-on)
- Legal hold, tenant hold, and eDiscovery packaging
- Dedicated compliance architect and custom SLA
Frequently asked questions
Factual clarity on APRA CPS 234 audit evidence, governance boundaries, and storage.
Defensible APRA CPS 234 Evidence for Boards & Auditors
Establish continuous technical control verification and verifiable governance attestations sealed in immutable AWS Sydney storage.