Free tool · APRA CPS 234 ¶35 and ¶36

When do you have to tell APRA?

CPS 234 has two notification clocks with different triggers and different deadlines. Enter the moment you became aware and see both.

¶35 · Material incident

72 hours

–

An information security incident that materially affected, or had the potential to materially affect, the entity or its depositors, policyholders, beneficiaries or other customers. Or any incident notified to another regulator, in Australia or elsewhere.

¶36 · Material control weakness

10 business days

–

A material information security control weakness you expect you will not be able to remediate in a timely manner. No incident is needed for this clock to start.

Day 0 is the day you became aware. 72-hour window business day counted not counted

Both clocks say "as soon as possible"

The 72 hours and 10 business days are the latest you can notify, not a target. Both run from when you become aware, not from when the incident started or the investigation finished, so the awareness time you record is the one APRA will ask about.

Would your process hit these?

Score all 24 CPS 234 requirements, including both notification obligations, in about 10 minutes.

Take the self-assessment or book a 30-minute call

General guidance, not legal advice. Deadlines follow APRA Prudential Standard CPS 234 Information Security, paragraphs 35 and 36, and are shown in your device's time zone. Only Saturdays and Sundays are skipped unless you tick the box; state public holidays and substitute days are never skipped. Confirm the position for your entity with your compliance or legal team.