Claims

APRA CPS 234: What It Means for Claims Systems

ClaimsGateway

16 Oct 26

•

min read

APRA's CPS 234 is the information security standard for regulated insurers. It has applied since 1 July 2019, and it covers information assets wherever they sit, including claims systems run by vendors. Insurers must assess a vendor's security capability, test controls, and notify APRA of material incidents within 72 hours.

This article is general information, not legal or compliance advice. Check the current text of the code, standard or legislation, and take advice for your situation.

Key takeaways

CPS 234 binds APRA-regulated entities, not software vendors, but it reaches vendors through the insurer's obligations.
According to MinterEllison, CPS 234 applies to information assets whether the entity manages them itself or a third party does.
An insurer must notify APRA within 72 hours of a material information security incident, and within 10 business days of a material control weakness it cannot fix in time.
A claims system holds some of an insurer's most sensitive data, so it is usually among the assets classified as critical and sensitive.
ISO/IEC 27001 certification helps a vendor answer CPS 234 questions, but it does not make the insurer compliant.

What is APRA CPS 234?

CPS 234 is APRA's prudential standard on information security. It requires regulated entities, including general insurers, to keep an information security capability that matches the threats they face, to protect their information assets, to test their controls and to notify APRA of material incidents. It commenced on 1 July 2019.

The standard is short, and much of the detail sits in APRA's guidance, CPG 234. It sets out who is responsible, starting with the board, and what the entity must do. That includes classifying information assets by criticality and sensitivity, implementing controls in proportion, testing those controls, and having internal audit review them.

For a claims team, the important point is scope. According to MinterEllison, the requirements apply to all of an entity's information assets, whether managed by the entity itself or by third parties and related entities. A claims platform run by a vendor is therefore inside the standard's reach.

Why are claims systems in scope?

Claims systems are in scope because they hold sensitive personal and financial information and support a critical function. Claim files contain health details, bank accounts, identity documents and records of loss. If a claims system is breached or goes down, policyholders are harmed directly, which is exactly the risk CPS 234 targets.

Claims data is also spread widely. A single claim can pass through an insurer, an underwriting agency, a TPA, loss adjusters, repairers and a payments provider. Each one may hold part of the file. As a result, an insurer's claims information assets often sit with several parties, not one.

CPS 230 reinforces the point. According to APRA, CPS 230 has applied since 1 July 2025, and it requires insurers to manage material service providers. The CPS 230 explainer covers how claims processing is treated as a critical operation.

What does CPS 234 ask about third parties?

Where a third party manages an insurer's information assets, the insurer must assess that party's information security capability, in proportion to the consequences of an incident. It must also make sure controls are tested, and that it will learn of incidents quickly. The vendor carries no obligation to APRA, but the insurer does.

According to Allens, CPS 234 requires an entity to evaluate the information security capability of third parties that manage its information assets. In practice, insurers do this through due diligence questionnaires, certification evidence, contract terms and periodic review. The contract is where the insurer secures what the standard needs: notification, testing evidence and the right to assess.

That has a practical consequence for vendors. A claims platform vendor can expect a detailed security questionnaire, requests for certification and test reports, and contract clauses on incident notice. The vendors that answer quickly and with evidence make the insurer's job easier.

What are the CPS 234 notification timeframes?

An insurer must notify APRA as soon as possible, and no later than 72 hours, after becoming aware of a material information security incident. It must also notify APRA within 10 business days of becoming aware of a material control weakness it cannot remediate in a timely way. Both clocks run from the insurer's awareness.

Those clocks are why vendor notice matters. If a claims platform vendor learns of an incident and takes days to tell the insurer, the insurer's 72 hours may already be running short when it finds out. So insurers usually require vendors to notify them well inside that window, and set that out in the contract.

The 72 hour rule applies where an incident materially affected, or could have materially affected, the entity or its customers, or where it has been notified to another regulator. The data sovereignty explainer looks at the related question of where claims data should live.

What should an insurer ask a claims software vendor?

Ask six things: which security certification the vendor holds and for what scope, where the data is hosted, how data is protected in transit and at rest, what activity is logged, how quickly the vendor will notify an incident, and what testing evidence it can share. Each answer should come with evidence, not assurance.

Certification and scope. A certificate such as ISO/IEC 27001 should name the organisation and the services it covers. Hosting location. Know the provider and the region, and whether data leaves Australia. Encryption. Ask about data in transit and at rest separately, because vendors often describe only one.

Logging. Ask which system and user activity is recorded, and for how long. Incident notice. Agree a notification time short enough to protect the 72 hour window. Testing. Ask for recent penetration test results or an independent assurance report, and how findings were fixed.

How does one claims vendor answer those questions?

ClaimsGateway (claimsgateway.com) answers several of those questions on its public security page. Its operating entity, Risk Management Gateway Pty Ltd, maintains an ISO/IEC 27001 certified information security management system. The platform is hosted on Microsoft Azure in the Australia East region in Sydney.

Its security page also states "SSL on all traffic", and says detailed audit logs record system and user activity, supporting monitoring, troubleshooting and investigations. Those facts are set out in full on the security and compliance page. An insurer would still need to ask ClaimsGateway, as it would any vendor, about encryption at rest, notification terms and testing evidence.

None of that makes an insurer compliant with CPS 234, and ClaimsGateway does not claim it does. The standard binds the insurer. A vendor's role is to give the insurer the evidence it needs to meet its own obligations.

Frequently asked questions

What is APRA CPS 234?

CPS 234 is APRA's prudential standard on information security, in force since 1 July 2019. It requires regulated entities such as insurers to maintain security capability matched to their threats, protect and classify their information assets, test controls and notify APRA of material incidents. It applies to assets managed by third parties too.

Does CPS 234 apply to software vendors?

Not directly. CPS 234 binds APRA-regulated entities, not their vendors. However, because it covers information assets managed by third parties, an insurer must assess its vendors' security capability and secure notification and testing commitments in contracts. So vendors meet CPS 234 expectations through the insurers they serve.

Is ISO 27001 enough for CPS 234?

No. ISO/IEC 27001 certification shows a vendor runs an audited information security management system, which helps an insurer's assessment. However, CPS 234 obligations sit with the insurer, which must still classify its assets, assess the vendor's controls for its own context, test them and meet the notification rules.

What are the CPS 234 notification timeframes?

An insurer must notify APRA as soon as possible, and within 72 hours, of a material information security incident. It must also notify APRA within 10 business days of a material control weakness it cannot remediate in a timely way. Both timeframes run from when the insurer becomes aware.

How does CPS 234 relate to CPS 230?

CPS 234 covers information security, while CPS 230 covers operational risk more broadly, including business continuity and material service providers. CPS 230 has applied since 1 July 2025. For claims, they overlap: a claims platform vendor is often both a holder of sensitive information assets and a material service provider.

About the author

ClaimsGateway builds cloud claims management software for insurers, underwriting agencies, brokers, TPAs and self-insured organisations in Australia and New Zealand. Every regulator figure in this article links to its source, and every vendor fact was checked on the vendor's own site on the date shown.