Quick answer
OptiTech runs CPS 234 for both audiences: APRA-regulated entities get the requirement catalog with board reporting that evidences oversight, asset classification, systematic controls testing, and the notification clocks (72 hours for material incidents, 10 business days for control weaknesses) built into the incident flow; their service providers get the assurance posture that answers the entity's third-party obligations without a bespoke audit per customer.
Evidence of governance, not just controls
CPS 234's board-accountability core maps to platform mechanics: security roles documented through control ownership, the policy framework in versioned documents with review cycles, and board reporting generated from live posture with trend, incidents, and open weaknesses, the artifact that answers "show us how the board oversees information security." Management review meetings get their input pack in one click, and the pack itself is logged as evidence.
Controls testing as a program
The standard demands systematic testing of control effectiveness. In OptiTech that's the default operating mode: continuous checks test the automatable controls daily, the testing calendar schedules pentests and recovery exercises with results attached, and identified weaknesses become findings with owners, whose escalation history demonstrates the required weakness-handling process. The 10-business-day APRA notification for unremediable material weaknesses hooks into that finding lifecycle with its own clock.
Asset classification including third parties
The asset inventory carries criticality and sensitivity classification, and third-party-managed assets link to the supplier register, where assurance evidence per vendor (certificates, reports, questionnaire responses) is maintained and re-assessed on a cadence, exactly the third-party assurance trail APRA examiners walk.
For vendors serving regulated entities
Publish your posture on a Trust Center, answer CPS 234-flavored questionnaires from live control data, and carry the incident notification commitments your contracts promise in your own incident flow, so your customer's 72-hour clock never depends on someone remembering a clause.
Get a personalized walkthrough of automated compliance for your team. No commitment required.