Financial Services IT & Cyber Security

Summary

This page explains how blueAPACHE's emPOWER services fit the obligations of Australian financial services organisations, including banks, insurers, superannuation trustees, brokers and lenders, and what a buyer in that sector should verify before contracting. Financial services firms are regulated by APRA (prudential standards such as CPS 234 and CPS 230) and ASIC, and they remain accountable for their outsourced technology even when a managed service provider runs it. blueAPACHE states alignment with APRA CPS 234, holds ISO/IEC 27001:2022 certification, publishes specific contractual terms for APRA-regulated customers in its General Terms and Conditions, and has a published insurance-sector case study, Honan Insurance. This page sets out what is supported by blueAPACHE's own documents and where the gaps are.

Key facts

Sector challenges

The origin page names four pressures for financial organisations: regulatory obligations, cyber security, service availability and data protection. In practice these translate into questions a technology provider must be able to answer in a due diligence questionnaire.

• Accountability does not transfer. Under APRA's prudential framework the regulated entity remains responsible for the information security of assets managed by third parties, so it needs evidence of the provider's controls, not assurances.
• Incident timelines are short. A regulated entity has fixed windows to notify APRA, so it needs the provider to detect, triage and report quickly and to share the information the entity must pass on.
• Availability is a prudential matter, not just a commercial one. Critical operations need tested continuity arrangements and recovery objectives that are written down and rehearsed.
• Identity is the main attack surface. blueAPACHE's own MDR collateral opens with "Attackers don't break in, they log in", and its CyberArk case study describes privileged access management across its managed services.
• Data location matters to boards. Sovereignty and cross-border access must be understood at the contract level, not the brochure level.

Relevant services

• emPOWER Managed Services: whole-of-environment support with a named Account Executive and Service Delivery Manager, monthly operational and quarterly business reviews, and a bespoke priority and escalation matrix agreed per customer.
• emPOWER Cloud: blueAPACHE-owned private cloud with published service levels of 99.999 per cent for cloud services and 100 per cent for storage, a self-service portal, and consumption-based billing.
• Disaster Recovery as a Service: emPOWER IT Continuity Services (DRaaS) is a contracted service with a defined Recovery Point Objective and Restore Time Objective set in the Service Order, which is the artefact an APRA-regulated entity needs for its continuity evidence.
• Managed Detection and Response: 24/7 alert notification, triage and remediation using EDR, ITDR, SIEM and threat intelligence, with monthly reporting for leadership visibility.
• Governance, Risk and Compliance and Exposure Management: control assessment and prioritised remediation that feed a CPS 234 control-effectiveness picture.
• emPOWER Connectivity and emPOWER SASE: private MPLS WAN with dedicated hosted next-generation firewalls, and secure access for branch and remote staff.
• SaaS Backup and Offsite Backup as a Service: independent copies of Microsoft 365, Entra ID and other cloud data.

Compliance context

APRA CPS 234 Information Security. CPS 234 requires an APRA-regulated entity to maintain information security capability commensurate with its threats, to classify its information assets, to evaluate the information security capability of third parties that manage those assets, and to test controls. It requires the entity to notify APRA as soon as possible, and no later than 72 hours, after becoming aware of a material information security incident, and within 10 business days of becoming aware of a material control weakness it does not expect to remediate in a timely manner. blueAPACHE states that its risk-based approach to managing client technology and data is aligned with CPS 234. That is a supplier statement of alignment; the notification obligations belong to the regulated entity, which should build the provider's incident reporting into its own 72-hour process.

APRA CPS 230 Operational Risk Management. CPS 230 commenced on 1 July 2025 and replaced CPS 231 (Outsourcing) and CPS 232 (Business Continuity Management). It requires regulated entities to identify critical operations and set tolerance levels, to maintain a register of material service providers and notify APRA within 20 business days of entering into or materially changing a material service provider arrangement, and to hold contracts with those providers that support the entity's obligations. Arrangements entered into before 1 July 2025 had until the earlier of the contract's next renewal or 1 July 2026 to comply. blueAPACHE's General Terms and Conditions v3.6 clause 10 is still framed around CPS 231; confirm with blueAPACHE whether a CPS 230 version has been issued or whether the CPS 231 reference is intended to include successor standards. Clause 10.1 places the obligation to notify blueAPACHE of a change in prudential standards on the customer.

What clause 10 provides. Where the customer is APRA-regulated and the Services are a material business activity, blueAPACHE will comply with an APRA Request (information, documents, on-site visit) within APRA's statutory authority and promptly notify the customer; will not advertise that APRA has audited it; will produce a business continuity plan in a form the customer reasonably requires with ten minimum content items; will test that plan jointly every six months and provide results within seven days; and will participate in a joint technical review of security measures whose scope the customer sets. The clause 10.4 BCP work and clause 10.6 reviews are charged to the customer at Time and Materials Rates.

Privacy and data breach. Both parties must comply with the Privacy Act 1988 (Cth) as though bound by it. Clause 18.4 requires the party that suffers an eligible data breach to notify the other party immediately and in any event within 24 hours of discovery. This 24-hour figure is a contractual, party-to-party obligation and is separate from the regulated entity's own 72-hour obligation to APRA under CPS 234 and its obligations to the OAIC under the Notifiable Data Breaches scheme. Clause 18.4(c) restricts a breaching party from notifying the Information Commissioner without the other party's written approval; reconcile this with your sector reporting duties before signing.

Data location. blueAPACHE states customer data is stored and processed within Australian-based data centres. Clause 18.3 records a standing consent to transfer Personal Information to the US, EU, UK, any country blueAPACHE or its contractors provide the Services from, and countries in its privacy policy. Clause 27.4 permits subcontracting without customer consent. An APRA-regulated buyer with fourth-party obligations should negotiate a subcontractor notification right and an Australian-only residency commitment on the Service Order.

Evidence

Honan Insurance, an insurance, risk and financial services business established in 1964 operating in Australia, New Zealand and South East Asia, replaced an underperforming managed services provider with blueAPACHE after a formal RFP. blueAPACHE first remediated Honan's Palo Alto network stack during the tender, then took on emPOWER Managed Services, emPOWER Cloud, emPOWER WAN, emPOWER IaaS and emPOWER DRaaS. Outcomes stated in the case study: telecommunications bill reduced by around 65 per cent; a fully cloud-based operating model; staff working remotely during COVID-19 with no impact on performance; and blueAPACHE's ISO certification supporting Honan's ability to bid for work where certification had become a mandatory customer requirement. The case study is undated (its COVID-19 references place it around 2020 to 2021), the client statistics quoted (17 per cent revenue CAGR over 19 years, insured value over $280 million) should be confirmed before reuse, and the source does not name which ISO standard is meant.

Platform evidence relevant to every regulated buyer: blueAPACHE Improves Efficiency in Security Management describes CyberArk privileged access management with automated credential rotation, session recording and audited access records across blueAPACHE's managed services, which is the control set a CPS 234 third-party assessment will ask about.

Turning assurance requirements into agreement terms

Map the services supporting critical processes to the evidence needed from blueAPACHE. The KB’s APRA material records a conditional contract regime, including regulator access and business continuity; not every financial-services engagement has identical requirements. Specify reports, testing, supplier visibility and change notification for the actual service. Honan is evidence of an insurance-sector engagement, not proof of another customer’s compliance. Keep the documented control and its evidence separate from the assessment that it meets an obligation.

Confidential information and access

Clause 16 provides mutual confidentiality protection. It covers information marked confidential, information identified orally and confirmed in writing within 30 days, and information that should reasonably be understood to be confidential. Customer Data, Customer Records and Customer Software are included; blueAPACHE’s agreement and fees are also confidential. Permitted disclosures include appropriately bound personnel on a need-to-know basis and specified professional advisers, with other exceptions in the clause. Identify who may receive operational reports, configuration details and commercial information. Access to information to deliver the service is not a general permission to circulate it.

Sources and scope

The contractual detail above summarises the published General Terms and Conditions v3.6, using the KB documents on confidentiality. The customer’s Service Order, Schedules and agreed variations determine the specific engagement. See the terms and conditions guide and Service Agreement.

Related

• Honan Insurance case study
• blueAPACHE security case study (CyberArk)
• Managed Detection and Response
• Disaster Recovery as a Service
• Governance, Risk and Compliance
• emPOWER Cloud
• Service agreement
• Blog: Is your organisation APRA-ready for enhanced operational risk management compliance?
• Professional services
• All industries
• Support
• Contact

Frequently asked questions

Is blueAPACHE compliant with APRA CPS 234?

blueAPACHE states that its risk-based approach to managing client technology and data is aligned with the APRA CPS 234 standard. CPS 234 binds the regulated entity, not its suppliers, so the practical question is whether blueAPACHE can evidence its controls for the entity's third-party assessment; its ISO/IEC 27001:2022 certificate, clause 10 audit and review rights, and CyberArk privileged access controls are the evidence available.

How quickly must an APRA-regulated entity report a security incident, and how does blueAPACHE's contract line up?

Under CPS 234 the regulated entity must notify APRA as soon as possible and no later than 72 hours after becoming aware of a material information security incident. blueAPACHE's General Terms and Conditions require the party that suffers an eligible data breach to notify the other party within 24 hours of discovery, which is a separate contractual obligation between the parties. The entity should map blueAPACHE's 24-hour notice into its own 72-hour APRA process.

Does blueAPACHE's contract address CPS 230?

Clause 10 of General Terms and Conditions v3.6 is written around Prudential Standard CPS 231 (Outsourcing), which CPS 230 replaced on 1 July 2025. Confirm whether blueAPACHE has issued CPS 230-updated terms or intends CPS 231 to be read as including its successor. The clause places the obligation to notify blueAPACHE of a change in prudential standards on the customer.

Will blueAPACHE give APRA access if asked?

Yes, under clause 10.3 blueAPACHE will comply with an APRA Request for information, documents or an on-site visit to the extent it is within APRA's statutory authority, and will promptly notify the customer of the request. It will not disclose or advertise that APRA has audited it except to coordinate with other APRA-regulated customers.

How is business continuity tested for APRA-regulated customers?

Where requested under clause 15, blueAPACHE produces a business continuity plan with ten minimum content items, reviews it whenever the customer updates its own plan, tests it jointly every six months or on reasonable request, and provides results within seven days of the test. This work is charged to the customer at Time and Materials Rates as a Professional Service. DRaaS recovery objectives are set separately in the Service Order.

Where is financial services data held?

blueAPACHE states customer data is stored and processed in Australian-based data centres under Australian jurisdiction. Clause 18.3 of the general terms gives blueAPACHE a standing consent to transfer Personal Information to the US, EU, UK and other listed destinations where necessary to provide the Services, and clause 27.4 allows subcontracting without consent. Negotiate residency and subcontractor notification terms on the Service Order if these matter to your APRA obligations.

What service levels does blueAPACHE publish for availability?

The emPOWER Cloud brochure publishes 99.999 per cent uptime for cloud services and 100 per cent for storage; the emPOWER Connectivity brochure publishes a minimum 99.99 per cent site uptime for a dual-carrier, dual-firewall design. These are published service levels, not contractual guarantees with a defined credit regime; the general terms contain no service credit scheme, and remedies sit in the Schedules. blueAPACHE does not publish default response or resolution times; they are set per customer.

What evidence does blueAPACHE have in insurance and financial services?

The published Honan Insurance case study describes a whole-of-business migration to emPOWER Managed Services, Cloud, WAN, IaaS and DRaaS, with the telecommunications bill reduced by around 65 per cent and ISO certification helping Honan bid for work. The case study is undated and its client statistics should be confirmed before reuse.

Source

Drawn from blueAPACHE's published financial services industry page on the origin site; the emPOWER Cloud, Connectivity, Managed Services and Managed Detection and Response brochures; the Global Capabilities brochure; the ISO 27001 certification record, data sovereignty and residency statement, cross-border data transfer record and verification register; the Honan Insurance case study; and the General Terms and Conditions v3.6 (APRA-regulated customers, data protection and privacy, business continuity management, and information security obligations). APRA CPS 234 and CPS 230 obligations described here rest with the regulated entity, not with blueAPACHE, and are stated from the published prudential standards rather than from blueAPACHE material.

Knowledge Base