Don’t Let Your Company Make Headlines for the Wrong Reasons: Why APRA’s New Standards Demand a Smarter Approach to Unstructured Data Management

Australian banks, superannuation funds, and insurance companies are facing unprecedented scrutiny under the Australian Prudential Regulation Authority’s (APRA) strengthened regulations for cybersecurity and operational risk. Failure to comply doesn’t just mean financial penalties—it could lead to significant reputational damage, business disruptions, and even personal liability for executives.

With CPS 230 taking effect on July 1, 2025, APRA-regulated entities must adopt stricter operational risk management controls to ensure resilience against cyber threats and system failures. This dovetails with CPS234, which mandates stronger governance and accountability for information security across financial institutions.

The challenge? 90% of a company’s data is unstructured—emails, chat logs, social media posts, videos, and audio files—and it is all essential for day-to-day operations but notoriously difficult to govern. If companies don’t take control of this unstructured data, it can become a target for cyberattacks, compliance failures, and operational inefficiencies.

Why Unstructured Data is at the Heart of APRA Compliance

Recent cyber incidents highlight the growing risks. Take MediSecure, which suffered a data breach impacting 12.9 million Australians, exposing sensitive health information. Just months later, the company entered voluntary administration—a worrying reminder of the consequences of poor data governance.

According to the Office of the Australian Information Commissioner (OAIC), there were 527 data breaches from January to June 2024, with cybersecurity incidents representing 38% of the total. In response, APRA now requires financial institutions to:

• Identify and secure critical data assets
• Report breaches within 72 hours
• Notify APRA of disruptions to critical operations within 24 hours

With these regulations in place, financial institutions can no longer afford to neglect their unstructured data. Failing to govern this data effectively increases vulnerability to attacks and slows recovery efforts after a breach.

Turning Compliance into a Competitive Advantage

CPS230 mandates that financial entities quickly recover operations in the wake of cyber incidents, requiring the ability to switch to clean systems instantly. Without visibility into unstructured data, recovery efforts become chaotic, much like searching for a specific book in a vast library without an index.

CPS234 will hold boards and senior executives accountable for cybersecurity measures. It is therefore important that leadership ensures security controls remain effective against emerging threats and maintain operational continuity.

Further complicating matters, third-party risk management is also under the microscope of APRA. With the growth of cloud services within financial institutions and external partner vendors, Gartner® research warns that third-party cybersecurity failures can lead to business interruptions, financial loss, and reputational damage. Regulatory bodies now expect organizations to embed:

• Pre-contract due diligence on vendors’ security practices,
• Incident response plans tailored for third-party risks,
• Exit strategies ensure continuity when vendors fail.

How Organizations Can Strengthen Compliance with Smarter Data Governance

To comply with CPS 230 and CPS 234, organizations must gain control over unstructured data by:

• Identifying critical data assets required for daily operations,
• Reducing unnecessary and duplicate files to streamline data security,
• Implementing intelligent classification tools to improve data visibility,
• Enhancing vendor risk management with integrated monitoring solutions.

Advanced data governance platforms can assess, organize, and protect unstructured data, turning compliance into an opportunity rather than a burden. After all, you can’t protect what you can’t see.

The countdown to July 1, 2025, is on. Taking a proactive approach to operational risk management and unstructured data management, financial institutions can strengthen their resilience, mitigate regulatory risks, and safeguard their reputation.