Cyber security compliance in Australia
Australia regulates cyber security by sector and by asset rather than through one national control set. Government entities follow the PSPF and the ISM; APRA-regulated banks, insurers and superannuation trustees follow CPS 234 and, since July 2025, CPS 230; operators of critical infrastructure keep a risk management program under the SOCI Act; and everyone handling personal information answers to the Privacy Act. Several of the dates in circulation are wrong, so this page sets out what applies and from when, from the instruments themselves.
- Frameworks listed10
- Issuing bodies9
- Framework pages6
- Platform languagesEnglish and Arabic
- DeploymentSaaS, private cloud or on-premises
Cybersecurity and data protection frameworks in Australia
Who issues each one and who must comply. Open a framework for its structure, obligations and how GRCLens runs it.
Prudential Standard CPS 234 Information Security
ADIs, general and life insurers, private health insurers and RSE licensees, on a group basis. In force since 1 July 2019, never amended
Open the framework page →Prudential Standard CPS 230 Operational Risk Management
The same APRA-regulated entities. Commenced 1 July 2025; re-made with the non-traditional service provider exemption, in force 1 July 2026
Open the framework page →Protective Security Policy Framework (PSPF)
Non-corporate Commonwealth entities (mandatory) and their providers by contract. 2025 Annual Release
Open the framework page →Information Security Manual (ISM) and IRAP assessment
Systems handling government data, including cloud services consumed by agencies; assessed by IRAP assessors. ISM updated quarterly
Open the framework page →Essential Eight Maturity Model
Mandatory at Maturity Level Two for non-corporate Commonwealth entities under the PSPF; a recognised CIRMP framework under SOCI
SOCI Act critical infrastructure risk management program (CIRMP)
Responsible entities for critical infrastructure assets in thirteen classes; enhanced rules for nine of them commenced 10 June 2026
Read the guide →AESCSF (Australian Energy Sector Cyber Security Framework)
Energy market participants; a recognised CIRMP cyber framework at Security Profile 2 under the enhanced rules
Open the framework page →Victorian Protective Data Security Framework (VPDSF)
Victorian public sector bodies under Part 4 of the Privacy and Data Protection Act 2014 (Vic); PDSP attestation every two years
Open the framework page →Privacy Act 1988 and the Notifiable Data Breaches scheme
APP entities. 2024 amendments: statutory tort for serious invasions of privacy from 10 June 2025; automated decision-making transparency from 10 December 2026
Cyber Security Act 2024 — ransomware payment reporting
Businesses with turnover above $3 million and responsible entities for critical infrastructure. Report a ransomware payment to ASD within 72 hours; in force since 30 May 2025
Which cyber security rules apply in Australia?
It depends on what you are, not where you are. Commonwealth entities apply the Protective Security Policy Framework, which points at the ISM and the Essential Eight for technical controls. APRA-regulated financial institutions apply CPS 234 for information security and CPS 230 for operational resilience. Operators of critical infrastructure assets maintain a risk management program under the Security of Critical Infrastructure Act 2018, choosing a recognised cyber framework such as the Essential Eight, ISO/IEC 27001, NIST CSF or the AESCSF. Every APP entity answers to the Privacy Act and its Notifiable Data Breaches scheme.
A large bank is usually all four at once: an APRA entity, a SOCI responsible entity, an APP entity and a supplier to government. That is why GRCLens runs the Australian frameworks on one control model.
What do APRA's CPS 234 and CPS 230 require?
CPS 234 makes the Board responsible for information security and sets 24 obligations across capability, policy, asset classification, controls, incident management, control testing, internal audit and notification — with two clocks: 72 hours to notify APRA of a material incident or one reported to any other regulator, and 10 business days for a material control weakness. It has not been amended since 2019; what has changed is supervision, through APRA's tripartite reviews and its letters on backups, cyber hygiene and AI.
CPS 230 replaced the outsourcing and business continuity standards from 1 July 2025 and was re-made on 1 July 2026. It requires a register of critical operations with Board-approved tolerance levels, a business continuity plan tested annually against severe but plausible scenarios, and a register of material service providers submitted to APRA every year, with a mandatory clause set for every material agreement. Its clocks are 72 hours for a material operational risk incident, 24 hours for a critical operation outside tolerance and 20 business days after a critical-operation agreement is signed or changed.
Are CPS 230 and CPS 234 one framework or two?
Two, with different owners. CPS 234 sits with the CISO; CPS 230 with operational risk and procurement. CPS 230 requires CPS 234 to be met and accepts a CPS 234 incident notification as satisfying its own, so the two are cross-referenced rather than merged. GRCLens carries them as separate catalogues under Australia that share one sector profile and one evidence base.
What changed for critical infrastructure in 2026?
The enhanced CIRMP rules commenced on 10 June 2026 for nine of the thirteen asset classes, with twelve- and twenty-four-month periods to meet the new requirements: a framework uplift to Essential Eight Maturity Level Two, ISO/IEC 27001:2023, NIST CSF 2.0, C2M2 MIL2 or AESCSF Security Profile 2; phishing-resistant multi-factor authentication; a critical systems inventory; personnel checks; and supply chain mapping. The annual CIRMP report is due within 90 days of financial year end, approved by the board.
What does the Privacy Act now require?
The Notifiable Data Breaches scheme requires an eligible data breach to be notified to the OAIC and affected individuals as soon as practicable after the entity concludes it is eligible, with the assessment itself to be completed within 30 days. The 2024 amendments added a statutory tort for serious invasions of privacy, in force from 10 June 2025, and transparency requirements for automated decisions with a significant effect on individuals, which commence on 10 December 2026. For an APRA entity a serious incident can therefore trigger three notifications from one event: APRA under CPS 234, the OAIC under the Privacy Act and, for listed companies, the ASX under continuous disclosure.
How GRCLens runs the Australian frameworks together
CPS 234, CPS 230, PSPF, VPDSF, the AESCSF and SOCI CIRMP obligations share one control model with ISO/IEC 27001, NIST CSF and the Essential Eight, so a bank or an energy operator evidences a control once for APRA, the CISC and its auditors. APRA's notification clocks, the material service provider register and the critical operations tolerance levels are tracked as their own indicators. IRAP engagements run in a dedicated workspace with connector-collected evidence. The platform can be hosted in Australia or fully on-premises.
Cyber compliance in Australia: common questions
Which Australian organisations must comply with APRA CPS 234?
Every APRA-regulated entity: ADIs including foreign ADIs, general insurers, life companies including friendly societies, private health insurers and RSE licensees, and where an entity is the Head of a group, the whole group including entities APRA does not regulate.
When did CPS 230 take effect?
1 July 2025, with pre-existing contracts and smaller entities' business continuity requirements given until 1 July 2026. APRA re-made the standard with effect from 1 July 2026 to add the exemption for non-traditional service providers such as central banks and payment schemes.
How quickly must an APRA-regulated entity notify a cyber incident?
Within 72 hours under CPS 234 for a material information security incident or one notified to any other regulator, and within 10 business days for a material control weakness. Under CPS 230, 24 hours for a critical operation disrupted beyond its tolerance level.
Is CPS 234 the same as ISO 27001?
No. CPS 234 is a short principles-based prudential standard with Board accountability and APRA notification duties; ISO/IEC 27001 is a certifiable management system standard. Many controls overlap, which is why GRCLens maps them onto one control model, but APRA assesses against CPS 234's own paragraphs.
Does the Essential Eight apply to private companies?
Not directly. It is mandatory for non-corporate Commonwealth entities under the PSPF and is one of the recognised frameworks a critical infrastructure entity can adopt for its CIRMP; other organisations adopt it voluntarily or by contract.
Sources
Checked against the issuing bodies' own publications in September 2026. Regulations change, so confirm current requirements with the relevant regulator before relying on them.
- APRA, CPS 234 Information Security (F2018L01745)
- APRA, CPS 230 Operational Risk Management (F2026L00475)
- APRA, targeted amendments to CPS 230, 30 April 2026
- Department of Home Affairs, PSPF
- ASD, Information Security Manual
- Federal Register of Legislation, CIRMP Rules (F2023L00112, compilation 10 June 2026)
- Federal Register of Legislation, Cyber Security (Ransomware Payment Reporting) Rules 2025
- OAIC, Privacy and Other Legislation Amendment Act 2024
Run Australia's frameworks on one platform
See GRCLens with your own frameworks loaded. Need hands-on help? Cyber security and compliance services in Australia from Security Solution Consultants.