Testing evidence for CPS 234 and CPS 230
As an APRA-regulated bank or ADI, you must demonstrate that security controls actually work — not just that they exist on paper. CPS 234 requires systematic testing of your information security controls, CPS 230 requires operational resilience under disruption, and your board carries accountability for information security. NodeZero runs the attack-based testing and produces evidence you can put in front of your board and APRA supervisors.
Your specific challenges
APRA scrutiny is escalating
APRA's supervisory focus on cyber resilience keeps sharpening. CPS 230 is in force, and after credential-stuffing attacks on super funds in 2025 APRA told RSE licensees to self-assess their information security controls against CPS 234 by 31 August 2025.
CPS 230 resilience validation
Since July 2025, CPS 230 has required tolerance levels for critical operations and business continuity testing against severe but plausible scenarios.
Board accountability
CPS 234 makes the board ultimately responsible for information security. Attack-based testing evidence gives directors a factual basis for that oversight.
Built for your situation
Continuous security validation
Run internal, external and segmentation tests as often as your risk requires, then confirm fixes in internal environments with Quick Verify. Evidence for the systematic testing program CPS 234 requires.
Evidence for board reporting
NodeZero Insights tracks weaknesses, attack-path trends and time to remediate across every test, with evidence-pack exports that map findings to APRA CPS 230.
Detection under real attack
Run real attack techniques against the systems behind critical operations, with Tripwires decoys alerting your SIEM, to test whether your SOC sees an attacker touching the decoys.
Evidence your APRA controls hold under attack
See NodeZero run in your own environment, and where it applies to CPS 234 and CPS 230