- The headline is paragraph 55(d): for each material arrangement, the entity must "ensure it can conduct an orderly exit from the arrangement if needed". That's the job a deposit, a rebuild and an Exit Exercise do.
- The sub names paragraph 49(d): core technology services are material service providers by default, "unless it can justify otherwise". That's why software vendors land in the register.
- The visual is an example account for a superannuation fund: the core technology applications behind its critical operations, and a BCP exercise of a provider failure. Names, dates and contents are fictional and labelled.
- Paragraph numbers follow the version that commenced on 1 July 2026. The 2025 version numbered these paragraphs one higher (orderly exit 56(d), credible BCP 34(c), core technology services 50).
An orderly exit, if you need one. Evidence it works.
CPS 230 asks APRA-regulated entities to ensure they can execute their BCP and exit each material arrangement in good order, and core technology services count as material by default. Codekeeper rebuilds the software without the vendor and gives you dated evidence for your file.
Our guidance for material arrangements: Resilience Pro or Continuity Pro, plus an Exit Exercise. See the protections
- Trusted by 3,500+ teams
- ISO/IEC 27001:2022 certified
- Evidence mapped to CPS 230 paras 33, 43, 47 and 55
Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors
- Dates. The original standard "commences on 1 July 2025" (para 6 of the 2025 version; APRA media release of 17 July 2023). APRA's operational risk page says the updated CPS 230 "commence[s] on 1 July 2026" (targeted amendments finalised on 30 April 2026, adding "limited exemptions from specific contractual requirements for material arrangements" with certain service providers), and paragraph 6 of the July 2026 version says the same. The examples (central banks, clearing and settlement facilities) come from the list of exempt providers in the standard's attachment (paragraph 57), not from APRA's page; rechecked 7 Oct. For pre-existing contracts, the same page says the requirements apply "from the earlier of the next contract renewal date or 1 July 2026".
- Not used: production's "October 2025: Submit a complete Material Service Provider (MSP) register" (para 50 says the register goes to APRA "on an annual basis"; we found no October date), "July 2026: Deadline for non-SFIs to comply with … business continuity and scenario analysis" (not found), and the "six key controls" list, which isn't APRA's wording. Production's "Notify APRA of material incidents within 72 hours" is close to para 32 but isn't about software, so it's left out.
What CPS 230 asks
Keep critical operations going. Be able to exit.
CPS 230 asks every APRA-regulated entity to keep its critical operations within tolerance through severe disruptions, and to manage the risks of its service providers. For each material arrangement, that includes being able to leave in good order.
“For each material arrangement an APRA-regulated entity must: … (c) ensure it can execute its BCP if needed; and (d) ensure it can conduct an orderly exit from the arrangement if needed.”
“An APRA-regulated entity must, at a minimum, classify a provider of the following services as a material service provider, unless it can justify otherwise: … (d) for all APRA-regulated entities: risk management, core technology services and internal audit.”
“An APRA-regulated entity must: … (c) maintain a credible BCP that sets out how it would maintain its critical operations within tolerance levels through disruptions, including disaster recovery planning for critical information assets;”
“The testing program must be tailored to the material risks of the APRA-regulated entity and include a range of severe but plausible scenarios, including disruptions to services provided by material service providers and scenarios where contingency arrangements are required.”
Paragraph numbers follow the version that commenced on 1 July 2026. Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Where software you don't control fits
A register lists your providers. Evidence shows you could leave one.
Core technology providers end up in your material service provider register by default. The orderly exit from one depends on what you hold when it fails. Codekeeper holds it and proves it rebuilds.
Start from your register
Add the core technology applications behind your material arrangements.
Attach the protection
Resilience Pro or Continuity Pro for each one. The deposit syncs daily from the vendor's repositories.
Rebuild without the vendor
Run up to four rebuilds a year. Each successful run issues a dated Recoverability Certificate.
Exercise the exit
Add an Exit Exercise to your testing program, with a Tested Exit Report and an annex mapped to CPS 230.
- Para 33(c) mentions "disaster recovery planning for critical information assets". The row doesn't claim a deposit is a disaster recovery plan; it shows what the plan can start from.
- Resilience recovery is best effort under the Resilience Arrangement; the Resilience page carries that detail.
- Confirm before launch: whether the live environment map is a document customers receive (open item from the DORA and NIS2 pages).
- 16 Oct: Continuity Pro added; base Continuity no longer includes Agentic Verification, so the rebuild rows name the Pro levels only, and the level lists include Continuity Pro.
Evidence map
Evidence for each paragraph.
Every document is dated and tied to one application, so your file shows what was tested, how and when.
| CPS 230 | Codekeeper evidence |
|---|---|
| Para 47(a) Your approach to exiting agreements with material service providers | The recovery process step by step, and the components the application needs. Exit workbookBuild stepsSBOMEscrow Pro · Resilience Pro · Continuity Pro |
| Para 55(d) An orderly exit from the arrangement | AI agents rebuild the deposit in the Codekeeper AI Verification Lab, with no help from the vendor, and leave a deployable copy to start from. Recoverability CertificateRun reportDeployable copyEscrow Pro · Resilience Pro · Continuity Pro |
| Para 55(c) Able to execute the BCP | A recovery Codekeeper runs for you. With Continuity, we also keep the live environment paid and switched on for an agreed period while we recover. Resilience ArrangementLive environment mapResilience · Resilience Pro · Continuity · Continuity Pro |
| Para 33(c) Disaster recovery planning for critical information assets | The deposit your plan starts from, held by a neutral party, synced daily, checked and certified. Software Resilience CertificateVault reportEvery protection |
| Paras 42 and 43 Testing, including disruption to material service providers | Dated rebuilds, four a year, run when you choose. Add an Exit Exercise to test the business functions you nominate, without the original developers. Dated Recoverability CertificatesTested Exit ReportCPS 230 annexPro levels · Exit Exercise as an add-on |
| Para 47(c) Fourth parties your material service providers rely on | We map where the application runs, the accounts it depends on and the services it needs at setup, and keep the map current. Live environment mapContinuity · Continuity Pro |
Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your assessor to decide.
Which protection fits
Who runs the recovery when a provider stops?
Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on. At every protection, Pro adds Agentic Verification.
Escrow
Released to you→Self-Run Recovery
When the agreed conditions are met, the deposit is released to you. Escrow Pro adds proof it builds, from $449. Explore Escrow
From $199
Resilience
Comes to us→Managed Recovery
If the application fails, Codekeeper runs the recovery for you. Resilience Pro starts from a deposit we know builds, from $649. Explore Resilience
From $399
Continuity
Live service kept on+Managed Recovery
Everything in Resilience, plus the live environment kept paid and switched on for an agreed period while we recover. Continuity Pro adds proof it builds, from $1,699. Explore Continuity
From $1,449
Prices per application per month, for software applications; SaaS and AI applications have their own rows. Setup is $499 per arrangement for Escrow and Resilience, and $999 for Continuity. Our guidance for material arrangements: Resilience Pro or Continuity Pro, plus an Exit Exercise. It's guidance, not a compliance promise. See all prices
Exit Exercise, from $12,000
An add-on to any plan, for your testing program: our specialists rebuild the application in a clean room and test the functions you nominate. The Tested Exit Report comes with an annex mapped to CPS 230.
Sample evidence pack
See what your auditor would receive.
An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.
- Recoverability Certificate
- Run report
- SBOM and Exit workbook excerpts
Questions
CPS 230, answered.
What is CPS 230?
APRA's Prudential Standard CPS 230 Operational Risk Management. Its key requirements include that an APRA-regulated entity must “be able to continue to deliver its critical operations within tolerance levels through severe disruptions, with a credible business continuity plan (BCP)” and “effectively manage the risks associated with service providers, with a comprehensive service provider management policy, formal agreements and robust monitoring.”
When did it take effect?
CPS 230 commenced on 1 July 2025. An updated version, with limited exemptions for certain non-traditional service providers such as central banks and clearing and settlement facilities, commenced on 1 July 2026. For contracts with service providers already in place, the requirements applied from the earlier of the next renewal date or 1 July 2026.
Who does it apply to?
All APRA-regulated entities: authorised deposit-taking institutions, including foreign ADIs; general insurers, including Category C insurers; life companies, including friendly societies and eligible foreign life insurance companies; private health insurers; and RSE licensees, with the related holding companies paragraph 2 lists. For foreign ADIs, Category C insurers and EFLICs, it applies to their Australian branch operations.
Are our software vendors material service providers?
Often, yes. Paragraph 48 defines material service providers as those the entity relies on to undertake a critical operation, or that expose it to material operational risk. Paragraph 49 says providers of core technology services must be classified as material unless you can justify otherwise.
What does CPS 230 say about exiting a provider?
Your service provider management policy must cover your approach to “entering into, monitoring, substituting and exiting agreements with material service providers” (paragraph 47). For each material arrangement, you must ensure you can conduct an orderly exit if needed (paragraph 55).
How should we test?
Paragraph 42 asks for a systematic testing program for your BCP that covers all critical operations and includes an annual business continuity exercise. Paragraph 43 says it must include severe but plausible scenarios, including disruptions to services provided by material service providers. A rebuild without the vendor and an Exit Exercise give that scenario real evidence.
Will this make us compliant with CPS 230?
Codekeeper gives you evidence for your CPS 230 file: certificates, run reports, SBOMs, Exit workbooks and Tested Exit Reports with an annex mapped to CPS 230. Whether it meets a specific requirement is for you and your assessor to decide.
We sell technology to Australian banks, insurers or super funds. Does this help us?
Yes. Your customers have to plan an orderly exit from you. With Escrow Pro you can show them your application rebuilds without your team, before they ask. Either party to the agreement can request an Exit Exercise.
Want the background first? Our CPS 230 guide is in Resources.
Show the orderly exit before you need it.
We'll walk through your material service providers and show you the evidence each arrangement can produce.