8 Min Read
APRA's Prudential Standard CPS 230 Operational Risk Management took effect on 1 July 2025. Six months earlier, on 17 January 2025, the EU's Digital Operational Resilience Act (DORA) began to apply to banks, insurers, investment firms, payment institutions and most other EU financial entities. The two rules were written on opposite sides of the world, but they ask boards the same question: if a critical service fails, can you keep operating, and can you prove it?
Nordic Cyber Group has delivered DORA gap analyses, ICT risk frameworks and third-party programmes for Nordic banks and insurers. We now work with Australian institutions from Melbourne. This article sets out where CPS 230 and DORA overlap, where they differ, and what European firms learned the hard way that Australian firms can use now.
What is CPS 230?
CPS 230 is APRA's prudential standard for operational risk management. It applies to authorised deposit-taking institutions, general insurers, life insurers, private health insurers and RSE licensees. It replaced the older outsourcing and business continuity standards (CPS 231, CPS 232, SPS 231, SPS 232 and HPS 231) with one standard that covers operational risk, business continuity and service provider management together.
What is DORA?
DORA, Regulation (EU) 2022/2554, sets a single rulebook for ICT risk across the EU financial sector. Unlike CPS 230, it is focused on information and communication technology rather than operational risk as a whole, and it is backed by detailed technical standards that specify templates, timelines and contract clauses.
How do CPS 230 and DORA compare?
- Scope.CPS 230 covers all operational risk, including people, process and technology. DORA covers ICT risk and the resilience of digital services.
- What must be protected.CPS 230 uses "critical operations" and requires tolerance levels for each. DORA uses "critical or important functions".
- Third parties.CPS 230 requires a register of material service providers and a policy for managing them. DORA requires a register of information on every ICT third-party arrangement, in a standard EU template, submitted to supervisors. In November 2025 the EU supervisors used those registers to designate 19 critical ICT third-party providers for direct oversight.
- Contracts.Both set minimum contract terms. DORA's Article 30 lists them clause by clause.
- Incident reporting.CPS 230 requires notice to APRA within 72 hours of an incident likely to have a material financial impact or a material impact on critical operations, and within 24 hours of a disruption to a critical operation outside tolerance. DORA requires an initial report within 4 hours of classifying an ICT incident as major and no later than 24 hours after becoming aware of it, an intermediate report within 72 hours of that, and a final report within one month of the last intermediate report.
- Testing.CPS 230 requires a business continuity plan for critical operations and a programme to test it, including scenario analysis. DORA adds threat-led penetration testing at least every three years for firms that supervisors select.
- Accountability.Both put ultimate responsibility on the board, or the management body under DORA.
Is CPS 230 the Australian version of DORA?
No. CPS 230 is closer to the UK's operational resilience rules than to DORA. It is principles-based and wider in scope, while DORA is prescriptive and focused on technology. But the core mechanics are the same: know your critical services, know who you depend on to deliver them, set limits on how much disruption you can absorb, and test that you can stay within them. A firm that has done the work for one regime has done most of the thinking for the other.
What deadlines remain under CPS 230?
The main transition date has passed. Since 1 July 2026, the service provider requirements also apply to contracts that existed before CPS 230 commenced, even if they have not yet come up for renewal. APRA gave entities that are not significant financial institutions extra time on business continuity and scenario analysis, which also ended on 1 July 2026. Every APRA-regulated entity should now be able to show compliance across its whole contract portfolio, not only new agreements.
Five lessons from DORA that apply to CPS 230
- Build the service provider register from data, not surveys.The first DORA registers had to cover every contract in place on 31 March 2025 and reach EU supervisors by 30 April 2025. Many firms found that contract owners could not say which services supported which functions. Firms that pulled data from procurement, finance and the CMDB finished faster and with fewer errors than firms that sent questionnaires.
- Map critical operations end to end, including fourth parties.A cloud provider's subcontractor can take down a critical operation as easily as the provider itself. DORA forced European firms to trace subcontracting chains. CPS 230 asks the same question about material service providers, with less detail on how.
- Set tolerance levels you can evidence.A tolerance level that has never been tested is a guess. Agree the maximum period of disruption, acceptable data loss and minimum service level for each critical operation, then run scenarios that show whether you can meet them.
- Fix contracts in one pass.European firms that remediated contracts one supplier at a time ran out of time. Group suppliers by risk, agree a standard addendum covering audit, notification, termination and exit, and work through the material providers first.
- Decide incident thresholds before the incident.Under DORA, the 4-hour clock starts when you classify an incident as major. Firms without pre-agreed classification criteria lost hours in the first incidents arguing about severity. Define what counts as a material incident under CPS 230 and who decides, and rehearse it.
"The hardest part of DORA was never the regulation. It was finding out which suppliers actually ran which services. Australian firms are now facing the same question under CPS 230."
What should Australian firms with European operations do?
Australian banks and insurers with EU branches or subsidiaries face both regimes. Run one control set and map it to both, rather than two programmes. The DORA register of information can feed the CPS 230 material service provider register. DORA's incident classification can sit alongside APRA's notification thresholds in one playbook. One set of evidence, tagged to each requirement, saves the duplicated audit work that firms in both jurisdictions often fall into.
How Nordic Cyber Group helps
We have delivered DORA gap analyses and programme governance for Nordic banks and insurers, including Agria and Nordea, and built the DORA register of information for a Swedish fintech organization. From Melbourne, we apply the same methods to CPS 230, CPS 234, SOCI and the Essential Eight. See our Australian practice or book a free 30-minute consultation to talk through your CPS 230 position.
Thank you!
