APRA CPS 230 is an Australian prudential standard for operational risk management, operational resilience, and service-provider oversight. It applies to regulated financial entities and sets expectations for how they identify, monitor, and reduce disruptions that could affect critical business services.
In cyber security, CPS 230 matters because many serious incidents are not just technical failures; they are service outages, third-party compromises, or recovery failures. The standard pushes organisations to map important services, set tolerance for disruption, test controls, and prepare for incidents such as ransomware, cloud outages, supplier breaches, and data loss. It also makes vendor risk a first-class issue, so firms need due diligence, contractual controls, exit planning, and ongoing monitoring of outsourced providers. For defenders, CPS 230 is a framework for turning cyber resilience into measurable operational practice.