---
name: APRA CPS 234 Readiness
description: Read-only audit that assesses your Microsoft 365 information-security controls against APRA CPS 234 obligations for regulated financial entities.
---

# APRA CPS 234 Readiness

> **TL;DR:** This skill inspects your Microsoft 365 tenant and maps the protect, detect, and respond controls against APRA CPS 234 obligations, then scores how ready your regulated entity is.

## How does Microsoft 365 support APRA CPS 234 readiness?

APRA Prudential Standard CPS 234 requires Australian banks, insurers, and superannuation entities to maintain information-security capability commensurate with their threats, test control effectiveness, and notify APRA of material incidents promptly. This skill reads the controls that underpin those obligations across Microsoft Entra ID, Microsoft Defender XDR, Microsoft Purview, Exchange Online, and Microsoft Teams. It checks identity protection, data classification, audit logging, and incident detection in Microsoft Sentinel and Microsoft Defender for Cloud Apps. It produces an evidence-based readiness view, not a compliance certification.

## When should you run this skill?

- "Are we ready for an APRA CPS 234 information-security review?"
- "Map our Microsoft 365 controls to CPS 234 obligations for the board."
- "Do we have the detect and respond capability CPS 234 expects?"
- "Show me evidence that our information assets are protected before an APRA tripartite audit."
- "Which CPS 234 control areas are weak in our tenant?"
- "Prepare a readiness pack for our annual CPS 234 assurance attestation."
- "Has our incident-response telemetry got the coverage APRA wants?"

## How this skill works, step by step

1. Connect read-only to Microsoft Graph, Microsoft Entra ID, and the Microsoft Purview portal using least-privilege reviewer roles.
2. Read identity and access controls, including conditional access policies, multifactor authentication coverage, and privileged role assignments.
3. Inspect Microsoft Purview sensitivity labels, data loss prevention policies, and information-protection coverage on regulated data.
4. Review unified audit log status, mailbox audit settings, and retention to confirm control testing and assurance evidence exists.
5. Check Microsoft Defender XDR and Microsoft Sentinel for incident detection, alerting, and the response capability CPS 234 expects.
6. Examine Microsoft Defender for Cloud Apps and Exchange Online protection for third-party and external information-asset exposure.
7. Map each finding to the relevant CPS 234 obligation area: roles, capability, controls, testing, and incident notification.
8. Derive a readiness score per obligation area, weighting missing detection and response controls more heavily than informational gaps.
9. Output the per-control findings, an overall readiness rating, and prioritised remediation guidance.

## Output format

The skill returns a per-obligation findings table followed by a summary.

| CPS 234 obligation area | Control inspected | Status | Readiness weight |
| --- | --- | --- | --- |
| Information-security capability | MFA coverage across all users | Partial — 92 percent enforced | High |
| Control testing and assurance | Unified audit log enabled | Pass | Medium |
| Incident detection and response | Microsoft Sentinel analytics rules active | Gap — no rules deployed | High |

- Overall readiness rating expressed as a percentage and a band (Low, Developing, Ready).
- Count of control gaps grouped by CPS 234 obligation area.
- Top five prioritised remediation actions, highest weight first.
- Evidence references for each passing control to support assurance reporting.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Conditional access and identity protection review | Microsoft Entra ID P1 |
| Sensitivity labels and data loss prevention inspection | Microsoft 365 E3 |
| Incident detection and response review (Microsoft Defender XDR) | Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 |
| Cloud app exposure review (Microsoft Defender for Cloud Apps) | Microsoft 365 E5 or Defender for Cloud Apps standalone |
| SIEM analytics rules review (Microsoft Sentinel) | Microsoft Sentinel (Azure subscription, pay-as-you-go) |

### Least-privilege roles

- Global Reader
- Security Reader
- Compliance Administrator (read-only assessment use only, or Compliance Data Administrator where read access suffices)

### Microsoft Graph permissions (read-only)

- `Policy.Read.All` — reads conditional access and authentication policies.
- `Directory.Read.All` — reads users, groups, and privileged role assignments.
- `RoleManagement.Read.Directory` — reads directory role assignments for least-privilege checks.
- `SecurityEvents.Read.All` — reads security alerts and incident signals.
- `InformationProtectionPolicy.Read` — reads published sensitivity label configuration.
- Microsoft Purview data loss prevention and audit log settings, and Microsoft Sentinel analytics rules, are inspected via the Microsoft Purview portal, the Microsoft Defender portal, and PowerShell rather than Microsoft Graph.

## Scope and safety

This skill is read-only by default. It inspects configuration and telemetry to produce a readiness assessment and never changes tenant state.

This skill does NOT:

- Create, modify, or delete any policy, label, role, or configuration.
- Read the content of user mailboxes, files, or messages.
- Submit, file, or transmit any notification to APRA on your behalf.
- Constitute legal advice or a formal CPS 234 compliance certification.

## Sources and compliance

- [APRA Prudential Standard CPS 234 Information Security](https://www.apra.gov.au/information-security-cps-234)
- [Australian Prudential Regulation Authority (APRA) compliance offering — Microsoft Learn](https://learn.microsoft.com/en-us/compliance/regulatory/offering-apra-cps-234-australia)
- Maps to the [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model) controls for multifactor authentication and restricting administrative privileges, which support CPS 234 access controls.
- Aligns with Australian Government Information Security Manual (ISM) guidelines on event logging and monitoring, supporting CPS 234 control testing and incident detection.
- Output in Australian English.