Share this article
How to build a CPS 230-aligned TPRM program
Evan Rowse
GRC Subject Matter Expert
Accelerating security solutions for small businesses Tagore offers strategic services to small businesses. | A partnership that can scale Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. | Standing out from competitors Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market. |
With reliance on third-party services growing, so does the risk that a vendor-related disruption could affect your critical services. To address these risks, the Australian Prudential Regulation Authority (APRA) introduced CPS 230, which sets requirements for strengthening operational resilience.
The framework is built on three core pillars, one of which is service provider management,most closely aligned with what the industry calls third-party risk management (TPRM). This pillar can be quite demanding for organisations pursuing compliance, with many teams feeling underprepared for the expanded scope of its service provider management requirements. This guide will explain what CPS 230 actually requires from a TPRM program and how it fits into broader compliance.
What is CPS 230?
CPS 230 Operational Risk Management is APRA’s prudential standard, which outlines requirements for operational risk management, business continuity, and service provider management.
It applies to all APRA-regulated entities, including banks, insurers, and superannuation trustees. It came into effect on 1 July 2025, and APRA provided transitional arrangements for pre-existing contractual agreements. For pre-existing contractual arrangements, CPS 230’s service provider requirements applied from the earlier of the next contract renewal date or 1 July 2026. This means that all material arrangements must now comply.
The framework is built upon three core pillars that strengthen operational resilience:
While all three pillars have criteria written in to support operational resilience, organisations typically face more hiccups when implementing controls for service provider management.
{{cta_webinar14="/cta-blocks"}}
How CPS 230 expands service provider risk management beyond outsourcing
CPS 230 consolidates requirements previously covered by different APRA prudential standards into a single framework to manage operational risk, strengthen business continuity, and oversee service providers. The framework unifies requirements from:
Of these, CPS 231 had the most relevant foundation for TPRM. CPS 230 expands its coverage to include all material service provider arrangements, shifting focus toward:
- Lifecycle risk management: Organisations must manage material vendor relationships throughout the entire lifecycle, from onboarding to ongoing monitoring and exit planning
- Board accountability: CPS 230 emphasises board accountability for operational service management, including approving tolerance levels for critical disruptions and ensuring proper governance is in place. This includes maintaining a service provider risk management policy, which defines how to identify, assess, monitor, and respond to service provider risks.
- Fourth-party visibility: Organisations must document and monitor material dependencies beyond direct relationships, especially those supporting critical operations.
- Operational resilience: Organisations must consider how service provider disruptions could affect critical operations and build appropriate measures to maintain continuity.
Why service provider management is a CPS 230 challenge
For many organisations, aligning with CPS 230’s service provider management requirements calls for a major overhaul of their existing TPRM practices. An additional layer of complexity is the standard’s principles-based nature: it sets outcomes rather than prescribing controls. This means teams assess their risks and determine the controls and processes needed to meet those outcomes.
Another challenge is the manual, spreadsheet-based approach to vendor management that many organisations still rely on. While these may work in smaller, still-maturing environments, they become difficult to maintain as vendor ecosystems grow. Updates rely on periodic reviews, which can quickly become outdated—making it harder to support the ongoing monitoring CPS 230 expects.
“A gap I see often is entities confusing vendor assessment with vendor risk management. An assessment is a point-in-time exercise, but CPS 230 requires organisations to manage risk continuously throughout the life of an arrangement, including being prepared for what happens if a vendor can’t perform tomorrow. Most programs simply weren’t designed for that level of ongoing oversight.”
Evan Rowse
CPS 230 also expects organisations to manage risk throughout the vendor lifecycle, not just during onboarding. Particularly, it requires organisations to extend visibility beyond direct vendor relationships and manage the risks arising from material fourth parties, but existing programs may lack the mechanisms needed to identify them, let alone monitor them.
The expanded scope makes fourth-party risk management one of the most sensitive implementation areas. What often happens is organisations set up their material service provider register, run due diligence, and uplift their contracts—only to discover that the vendor they just approved is itself dependent on downstream dependencies they’ve never assessed and have no contractual visibility over.
{{cta_withimage20="/cta-blocks"}} | Vendor Risk checklist
What CPS 230 requires from your TPRM program
To manage service providers under CPS 230, you need to meet five core requirements:
- Identify material service providers
- Understand fourth-party dependencies
- Maintain formal service provider agreements with required contractual provisions
- Assess concentration risk
- Continuously monitor service providers
1. Identify material service providers
A material service provider is one that the entity relies on to undertake a critical operation, or one that exposes the entity to material operational risk. CPS 230 mandates that you proactively identify these providers and manage the risks they pose.
Don’t treat all material service providers equally. Classify them based on the criticality of the operations they support and the financial, operational, and information security risks they pose. This helps you tailor oversight and controls based on their risk tier.
2. Understand fourth-party dependencies
CPS 230 needs you to track material fourth-party dependencies, since downstream disruptions can quickly cascade across the supply chain and have the same impact as direct vendor incidents.
“To mitigate Nth-party risks, I’d start with your critical operations and work outward. You don’t need to map every fourth-party dependency across your entire vendor ecosystem as that would overwhelm your teams.
A more manageable scope: start with identifying the subcontractors that sit underneath the vendors supporting your most critical operations. Entities that try to boil the ocean on fourth-party risk end up with a sprawling exercise that only produces a massive risk register nobody maintains.”
Evan Rowse
Once you’ve mapped these dependencies, identify the most critical areas to prioritise oversight.
3. Maintain formal service provider agreements with required contractual provisions
APRA expects regulated entities to maintain formal, legally binding agreements for all material service provider arrangements. CPS 230 prescribes the minimum provisions each service provider agreement must include:
- Service description: Defines the provided service and associated service levels
- Rights, responsibilities, and expectations: Document each party’s responsibilities regarding audit access, data ownership, dispute resolution, and liability
- Compliance provisions: Ensure the agreement allows the organisation to meet its regulatory obligations
- Subcontractor notifications: Require the service provider to notify the organisation when it relies on material subcontractors to deliver services
- Liability for failures: Provisions that keep the service provider accountable for subcontractor failures
- APRA access rights: Provides APRA with access to information, documentation, and sites as required
Exceptions apply. On 30 April 2026, APRA finalised targeted amendments to CPS 230, introducing a limited exemption from specific contractual requirements for material arrangements with certain categories of non-traditional service providers (NTSPs). The amendments took effect on 1 July 2026. Exempt categories are: government agencies, regulators, central banks, financial market exchanges, operators of clearing and settlement facilities, operators of payment systems and schemes, and financial messaging infrastructures.
Organisations should also define processes to meet CPS 230 notification requirements. This includes notifying APRA of:
- Material service provider arrangements where needed
- Material disruptions that can or have materially impacted operations
Service provider agreements should ensure organisations receive relevant information and can meet regulatory requirements on time. The agreements must also cover termination provisions, including the ability to terminate the entire arrangement or only specific parts. This helps organisations exit arrangements that no longer meet their regulatory requirements or present risk beyond tolerable thresholds.
4. Assess concentration risk
Concentration risk arises when an organisation relies heavily on a single service provider, vendor, or platform to support critical operations. In these scenarios, when that dependency is disrupted, it impacts multiple business functions and halts operations.
Under CPS 230, organisations must identify concentration risks and their likelihood and impact, and then create a business continuity plan that minimises the impact. In practice, this means identifying singular failure points and determining alternative providers, backup arrangements, or other safeguards to reduce risk.
5. Continuously monitor service providers
You need to move away from periodic vendor assessments as CPS 230 requires regulated organisations to continuously monitor service providers and respond to changes in their risk posture. You have to set up continuous monitoring with the help of a well-rated risk management software to track changes in your vendor risk posture.
The ongoing monitoring trail can be a recurring problem for organisations. It’s a key compliance document, but many teams fail to produce it during audits. While a vendor register and signed contracts do show APRA you’ve done your due diligence, monitoring logs demonstrate that you’ve actively managed risks even after onboarding.
This means being able to back up how you’ve tracked performance against SLA’s, identified and escalated changes in the vendor’s risk posture, and reviewed the materiality classification when the scope of the arrangement changes. This continuous evidence documentation is a key gap separating a CPS 230-ready program from one that looks compliant on paper.
A platform like Vanta can help automate workflows and keep your evidence trail up to date with continuous third-party monitoring, risk scoring, and automated risk register updates.
How CPS 234 complements a CPS 230-aligned TPRM program
CPS 234 is another APRA prudential standard closely related to third-party risk management. However, while CPS 230 requires organisations to manage operational risks from service providers, CPS 234 focuses on information security risks, including those coming from third parties.
Because both address risks from third parties, there’s a common misconception that the two are interchangeable. In reality, the standards are complementary, and compliance with both supports a more comprehensive TPRM approach by combining vendor oversight with cybersecurity resilience.
Importantly, the overlap extends to reporting obligations: when an incident satisfies the notification requirements for both standards, APRA generally doesn’t expect you to send separate reports for each (see CPG 230).
Bonus read: Check out our CPS 234 compliance checklist.
What a CPS 230-aligned TPRM program looks like in practice
If your TPRM program still relies on spreadsheets, email threads, and periodic reviews to track vendor risks, maintaining oversight will be ineffective as your vendor ecosystem grows. A CPS 230-aligned program should connect key processes so teams can act on changes in risk rather than simply document them.
This requires you to:
- Identify and classify material service providers and subcontractors based on the criticality of the operations they support and the risks they introduce
- Define and regularly update processes for managing vendor risks throughout the vendor lifecycle
- Sharpen your SLAs to establish security, availability, and service delivery expectations
- String materiality, oversight, and response together with continuous oversight
Leading compliance automation solutions like Vanta can help connect these processes so you build a strong foundation for CPS 230 (and TPRM in general). You can automate repetitive workflows, enforce continuous oversight, and expand coverage to critical fourth-party relationships—all from one platform.
Operationalise CPS 230 and manage third-party risk with Vanta
Vanta is the leading agentic trust management platform that supports compliance and TPRM programs with AI-powered workflows, continuous monitoring, risk management, automated evidence collection, and more.
The platform’s third-party risk management product can help you adapt to modern regulatory requirements with features such as:
- Automated vendor and shadow AI discovery
- AI-powered questionnaires and standardised risk scoring
- Automated document requests and follow-ups (for keeping up with vendors)
- Continuous monitoring across your vendor ecosystem with 400+ integrations
- An always-on Vanta TPRM Agent to accelerate remediation
Vanta’s vendor scans continuously monitor for breaches, CVEs, dark web credential leaks, and fourth-party risks, surfacing actionable alerts as new risks emerge.
If you need support in the Australian or global compliance landscape, Vanta can help you align with 32+ leading standards and frameworks, including out-of-the-box options for CPS 234, Essential Eight, and Cyber Essentials. You can also build a custom framework that maps to CPS 230 alongside your other obligations.
Schedule a custom demo to try out Vanta’s features today.
{{cta_simple5="/cta-modules"}} | Vendor Risk Management product page
FAQs
What is a material service provider under CPS 230?
Under CPS 230, a material service provider is one that the entity relies on to undertake a critical operation, or one that exposes the entity to material operational risk. CPS 230 also lists specific provider categories (e.g., risk management, core technology, internal audit) that must be treated as material unless the entity documents a different conclusion.
Does CPS 230 require fourth-party risk management?
CPS 230 requires organisations to manage fourth-party risks. Additionally, APRA expects organisations to thoroughly describe how they manage vendor relationships if their fourth parties support any business-critical operations.
Who needs to comply with CPS 230?
All APRA-regulated entities must comply with CPS 230, including banks and other ADIs, insurers (general, life, and private health), and superannuation trustees. Material service providers aren’t directly subject to CPS 230, but APRA-regulated entities must manage the risks associated with these arrangements.
How does CPS 230 differ from CPS 231?
CPS 231 focused on outsourcing of material business activities. CPS 230 is much broader in scope, requiring organisations to manage all operational risks, manage critical operations during disruptions, and oversee all material service providers.
How does CPS 230 relate to CPS 234?
CPS 230 and CPS 234 address different sides of resilience:
- CPS 230 helps organisations keep critical operations running when disruptions occur
- CPS 234 focuses on protecting information and systems from security threats
When applied together, they help APRA-regulated entities build a thorough approach to resilience, covering both operational disruptions and information security risks.
How do I operationalise continuous third-party monitoring for CPS 230?
To implement continuous third-party monitoring for CPS 230, a robust approach is using automated risk dashboards to track vendor performance, resilience metrics, and incident alerts in real time. Use the data to review changes in critical services and dependencies, enforce or update SLAs, and reassess materiality as vendor relationships change.
Legal disclaimer: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.
“
“
FEATURED VANTA RESOURCE
The ultimate guide to scaling your compliance program
Learn how to scale, manage, and optimize alongside your business goals.
.svg)
.svg)
