Strengthening Operational Resilience and Security for APRA CPS 230 and CPS 234
Zscaler, Friday, November 6th, 2026
Zscaler outlines what APRA CPS 230 and CPS 234 require of Australian financial institutions and how zero trust architecture supports them.
APRA's CPS 234 on information security has applied since July 2019, and CPS 230 on operational resilience has applied since July 2025, with its transition period for existing service provider arrangements ending 1 July 2026.
CPS 230 requires institutions to identify critical operations, set Board-approved disruption tolerances, test continuity plans and notify APRA of material incidents within 72 hours, while CPS 234 makes the Board responsible for proportionate, tested security controls.
Zscaler says its Zero Trust Exchange enforces identity-based least-privilege access with inline inspection and logs every policy decision as audit evidence.
It adds that removing VPN hub-and-spoke designs and using Business Continuity Cloud reduce single points of failure.