APRA CPS 234 Readiness

TL;DR: This skill inspects your Microsoft 365 tenant and maps the protect, detect, and respond controls against APRA CPS 234 obligations, then scores how ready your regulated entity is.

How does Microsoft 365 support APRA CPS 234 readiness?

APRA Prudential Standard CPS 234 requires Australian banks, insurers, and superannuation entities to maintain information-security capability commensurate with their threats, test control effectiveness, and notify APRA of material incidents promptly. This skill reads the controls that underpin those obligations across Microsoft Entra ID, Microsoft Defender XDR, Microsoft Purview, Exchange Online, and Microsoft Teams. It checks identity protection, data classification, audit logging, and incident detection in Microsoft Sentinel and Microsoft Defender for Cloud Apps. It produces an evidence-based readiness view, not a compliance certification.

When should you run this skill?

• “Are we ready for an APRA CPS 234 information-security review?”
• “Map our Microsoft 365 controls to CPS 234 obligations for the board.”
• “Do we have the detect and respond capability CPS 234 expects?”
• “Show me evidence that our information assets are protected before an APRA tripartite audit.”
• “Which CPS 234 control areas are weak in our tenant?”
• “Prepare a readiness pack for our annual CPS 234 assurance attestation.”
• “Has our incident-response telemetry got the coverage APRA wants?”

How this skill works, step by step

1. Connect read-only to Microsoft Graph, Microsoft Entra ID, and the Microsoft Purview portal using least-privilege reviewer roles.
2. Read identity and access controls, including conditional access policies, multifactor authentication coverage, and privileged role assignments.
3. Inspect Microsoft Purview sensitivity labels, data loss prevention policies, and information-protection coverage on regulated data.
4. Review unified audit log status, mailbox audit settings, and retention to confirm control testing and assurance evidence exists.
5. Check Microsoft Defender XDR and Microsoft Sentinel for incident detection, alerting, and the response capability CPS 234 expects.
6. Examine Microsoft Defender for Cloud Apps and Exchange Online protection for third-party and external information-asset exposure.
7. Map each finding to the relevant CPS 234 obligation area: roles, capability, controls, testing, and incident notification.
8. Derive a readiness score per obligation area, weighting missing detection and response controls more heavily than informational gaps.
9. Output the per-control findings, an overall readiness rating, and prioritised remediation guidance.

Output format

The skill returns a per-obligation findings table followed by a summary.

• Overall readiness rating expressed as a percentage and a band (Low, Developing, Ready).
• Count of control gaps grouped by CPS 234 obligation area.
• Top five prioritised remediation actions, highest weight first.
• Evidence references for each passing control to support assurance reporting.

Licensing and permissions

Licences and add-ons

Least-privilege roles

• Global Reader
• Security Reader
• Compliance Administrator (read-only assessment use only, or Compliance Data Administrator where read access suffices)

Microsoft Graph permissions (read-only)

• Policy.Read.All — reads conditional access and authentication policies.
• Directory.Read.All — reads users, groups, and privileged role assignments.
• RoleManagement.Read.Directory — reads directory role assignments for least-privilege checks.
• SecurityEvents.Read.All — reads security alerts and incident signals.
• InformationProtectionPolicy.Read — reads published sensitivity label configuration.
• Microsoft Purview data loss prevention and audit log settings, and Microsoft Sentinel analytics rules, are inspected via the Microsoft Purview portal, the Microsoft Defender portal, and PowerShell rather than Microsoft Graph.

Scope and safety

This skill is read-only by default. It inspects configuration and telemetry to produce a readiness assessment and never changes tenant state.

This skill does NOT:

• Create, modify, or delete any policy, label, role, or configuration.
• Read the content of user mailboxes, files, or messages.
• Submit, file, or transmit any notification to APRA on your behalf.
• Constitute legal advice or a formal CPS 234 compliance certification.

Related skills

• Microsoft Secure Score Improvement Plan: run before this to rank open improvement actions by impact and effort
• Audit Log Retention and Coverage Validator: run alongside this to confirm audit logging and retention
• Compliance Manager Control Mapper: run after this to map tenant controls to frameworks in Compliance Manager
• Essential Eight Maturity Self-Assessment: run after this to score the eight Essential Eight mitigation strategies
• Australian Compliance for Microsoft 365 Copilot and AI: the pillar guide to Australian compliance for Microsoft 365 Copilot and AI

Sources and compliance

• APRA Prudential Standard CPS 234 Information Security 
• Australian Prudential Regulation Authority (APRA) compliance offering — Microsoft Learn 
• Maps to the ASD Essential Eight Maturity Model  controls for multifactor authentication and restricting administrative privileges, which support CPS 234 access controls.
• Aligns with Australian Government Information Security Manual (ISM) guidelines on event logging and monitoring, supporting CPS 234 control testing and incident detection.

Licensed under CC BY 4.0  by EDUC4TE .

Last reviewed 2026-06-04