You're not the APRA-regulated entity. You're the third party their CPS 234 assessor is asking about.
Brokers, MGAs, claims handlers, TPAs, and insurtech platforms are not APRA-regulated directly — but you sit inside APRA-regulated supply chains under CPS 234's third-party service-provider obligations and CPS 230 material service provider requirements. Your insurer customers are being asked to evidence the security of the information assets they manage through you. Allianz Life was breached in July 2025 via a third-party CRM. Cyber Security Act ransomware payment reporting still applies to you over $3M turnover.
Your specific challenges
Your customers now need third-party evidence
Under CPS 234, APRA-regulated entities must ensure the security of information assets managed by their service providers. CPS 230 extends this to material service providers more broadly.
Third-party platforms are in the attack path
Allianz Life's July 2025 breach came through a third-party cloud CRM reached by social engineering. CPS 234 already requires regulated entities to evaluate the information security capability of third parties that manage their information assets.
Mandatory ransomware reporting still applies
Cyber Security Act 2024 mandatory ransomware reporting covers you over $3M turnover — independent of whether your insurer customer also has to report.
Built for your situation
Third-party evidence customers can use
NodeZero findings provide structured evidence your APRA-regulated customers can include in their CPS 234 third-party assurance, alongside a SOC 2 report.
Cloud and identity testing
Cloud pentesting tests AWS, Azure and Entra ID, and Kubernetes environments for IAM misconfigurations and privilege-escalation paths.
Ransomware path reduction
Pre-incident AD Password Audit, Phishing Impact, and credential-reuse testing target the attack paths ransomware actors exploit.
Give your insurer customers third-party evidence that holds up
See how NodeZero produces CPS 234 third-party and CPS 230 material service provider evidence