APRA CPS 230, operational resilience as ongoing control work.
One standard pulls together operational risk, business continuity, and service-provider management. Cybereen runs it as living control work — critical operations mapped, tolerances tracked, the provider register current — not a once-a-year scramble.
One standard, three obligations.
CPS 230 is APRA's operational risk standard. It requires regulated entities to manage operational risk, maintain critical operations within board-set tolerances, and manage the service providers those operations depend on.
It consolidates the old outsourcing and business-continuity standards (CPS 231 and CPS 232) into one, and raises the bar: you must identify your critical operations, set tolerance levels for the maximum disruption you can absorb, and prove — through scenario testing — that you can stay inside them.
The service-provider piece reaches further than old outsourcing rules: a register of material service providers, managed arrangements, and visibility of fourth parties your providers rely on. The board carries accountability throughout.
Identify · Set · Test · Report. On a continuous clock.
CPS 230 isn't an annual document — it's a cycle. Cybereen schedules each step, assigns the owner, and keeps the evidence the board and APRA expect.
Critical operations.
Map the operations that, if disrupted, would materially affect customers or financial stability — and the processes, people, and providers behind each.
- Critical operations list
- Dependency mapping
- Process → provider links
Tolerance levels.
Define the maximum level of disruption the board will tolerate for each critical operation — time, data loss, and minimum service.
- Tolerance per operation
- Board-approved
- Reviewed as you change
Scenario & continuity.
Run business continuity and scenario tests against the tolerances. Prove you can stay inside them — and capture where you couldn't.
- BCP + scenario tests
- Results vs tolerance
- Remediation tracked
Board & incidents.
Report operational risk to the board, notify APRA of material incidents, and feed lessons back into controls and tolerances.
- Board reporting pack
- Incident notification
- Lessons → controls
Three obligations. One register of evidence.
CPS 230 bundles three bodies of work that used to live apart. Cybereen runs them on one platform so the evidence reinforces, rather than duplicates.
Identify, assess, and manage operational risk; maintain effective controls; manage operational risk incidents end to end.
Critical operations, tolerance levels, a business continuity plan, and scenario testing that proves you can stay within tolerance.
A register of material service providers, managed arrangements, monitoring, and visibility of the fourth parties they depend on.
The board owns operational risk management — approving tolerances, overseeing critical operations, and holding management to account.
Critical operations and providers. In one live view.
Your critical operations, their tolerances, the providers they depend on, and the test evidence that proves resilience — current, not reconstructed the week before a board meeting.
- Critical operations register — each mapped to its processes, providers, and tolerance.
- Service-provider register — material providers, arrangements, and fourth-party exposure.
- Tolerance tracking — set, board-approved, and tested against scenario results.
- Incident management — operational incidents logged, with APRA notification timelines.
- Evidence reuse — your CPS 234 and ISO controls pre-fill the overlap.
Three places CPS 230 programmes slip.
Patterns we see as entities move off the old CPS 231/232 world.
Tolerances set, never tested.
Writing tolerance levels is the easy half. APRA expects evidence you can stay within them — from real scenario tests, not an assertion in a policy.
A provider register that rots.
A material-service-provider register is only useful if it's current. New SaaS gets wired in monthly; an annual refresh means it's wrong most of the year — and blind to fourth parties.
Continuity treated as a binder.
Carrying CPS 232's annual-BCP habit into CPS 230 misses the point. Operational resilience is continuous — critical operations and dependencies shift through the year.
Questions before your transition.
If yours isn't here, the contact form has a free-text field — answers go in the next page revision.
When does CPS 230 take effect?
What does it replace?
How is CPS 230 different from CPS 234?
What counts as a "critical operation"?
How does Cybereen handle the service-provider register?
Run CPS 230 as control work, not a project.
Map critical operations, set and test tolerances, keep the provider register live — on the same platform as CPS 234 and your ISO controls. Book a walk-through and we'll map it to your operations.