CPS 234 paragraph 27 requires a systematic testing program. NodeZero produces the testing evidence.
As an APRA-regulated general, life, or private health insurer, you hold concentrated PII, payment data, and in many cases sensitive health and claims data. CPS 234 paragraph 27 requires testing commensurate with the rate of change of your environment. CPS 230 adds tested critical operations resilience. FAR puts personal exposure on the accountable person. The first tranche of APRA's tripartite CPS 234 assessments found common gaps in third-party assessment and control testing.
Your specific challenges
Paragraph 27 asks for systematic testing
CPS 234 paragraph 27 requires entities to test the effectiveness of their information security controls through a systematic testing program. NodeZero shows what actually happens when an attacker tries to exploit the environment, evidence you can put in front of an assessor.
Scattered Spider tradecraft targets help desks
Google warned in June 2025 that the actor targets help desks and call centres through social engineering. Once a credential is handed over, what matters is how far it reaches inside your environment.
Capital consequences are now live
APRA's $250M capital adequacy increase on Medibank, reflecting weaknesses in its information security environment, showed cyber weaknesses can drive prudential capital outcomes.
Built for your situation
Continuous paragraph 27 evidence
NodeZero produces testing evidence for CPS 234 paragraph 27 — an initial test, ongoing testing as the environment changes, and re-testing after remediation.
Phished-credential impact
Phishing Impact Testing takes the credentials your phishing tool captures and proves how far a phished login can actually reach. Help desk procedures themselves sit outside NodeZero's testing.
Evidence for CPS 234
Findings give you evidence of control testing under CPS 234 paragraph 27, and surface control weaknesses early enough to assess them for APRA notification.
See what an attacker could reach before your tripartite assessor asks
See what an attacker could reach in your environment, and where NodeZero produces evidence for CPS 234 paragraph 27