CPS 234: What small NSW businesses actually need to do

APRA's Prudential Standard CPS 234: Information Security is often described as a rule for banks, insurers and superannuation funds. In practice, small and medium NSW businesses feel its effect long before they are directly regulated by APRA. The reason is that your clients are regulated, and they ask you to evidence the same controls.

Who it actually applies to

CPS 234 applies to APRA-regulated institutions. If you are a small law firm, a medical practice, an accountant or an IT reseller, you are not directly covered. But if you provide services to a financial institution, an insurer, a super fund or a body corporate with financial-sector obligations, they will ask you to demonstrate controls that align with CPS 234. We see this in client contracts, in vendor due diligence questionnaires, and in security review invitations.

The core obligations, in plain terms

CPS 234 asks regulated entities to:

• Identify information assets that matter.
• Assess the threats to those assets.
• Apply controls proportionate to the risk.
• Test whether the controls work.
• Notify APRA if a material incident occurs.
• Require the same of third-party providers.

For a small business, the last point is the one that reaches you. Your client's security team sends you a questionnaire. They want to know what your backup regime is, how you handle access for departing staff, whether you have tested your incident response, and where their data is hosted.

What we recommend small businesses do

You do not need to hire a CISO. But you do need a written document that describes the controls you already have. A three-to-five page document is enough for most small businesses. It should cover:

• The systems that hold client data.
• Who has access, and how often that access is reviewed.
• Where data is backed up, and how often restores are tested.
• The firewall and email protection in place.
• The process an employee follows if they suspect a breach.
• The contact details for the person responsible for information security in your business.

The questions that usually trip people up

The two questions we see small businesses fail most often are:

"When did you last test a restore?" If the answer is "we have backups" but no one has ever restored from one, that is not a tested control. We recommend a documented quarterly restore test.

"When did you last review user access?" If no one has reviewed who has access to the file server since a former employee left two years ago, you have an access control gap. We recommend a quarterly access review signed off by the practice manager.

CPS 234 is not a tax on small business. It is a document your clients will ask for. The businesses that have it ready win the work; the businesses that do not, scramble.

Where to start

If your business holds client data that a regulated entity cares about, start with the written control statement. Then implement the two controls that usually trip people up: tested backups and quarterly access reviews. The rest can follow.