CATAAM Adds Support for Australia’s Privacy Act (APPs) and APRA CPS 234

CATAAM today announced expanded support for Australian compliance, adding the Australian Privacy Principles (APPs) under the Privacy Act 1988 and APRA Prudential Standard CPS 234 (Information Security) to its governance, risk and compliance (GRC) platform. The two frameworks join the ACSC Essential Eight — already live on CATAAM — to give Australian organizations a single platform for the privacy, prudential and cyber-hygiene obligations they are most often asked to meet.

What’s now supported

The Australian Privacy Principles are the thirteen principles at the core of the Privacy Act 1988 (Schedule 1) that govern how organizations collect, use, disclose and secure personal information — together with the Notifiable Data Breaches (NDB) scheme. CATAAM maps each principle to concrete, testable controls — reusing the data-privacy controls it already runs for GDPR where the obligations overlap, and adding APP-specific controls for the rest — so an organization can demonstrate privacy compliance from live evidence rather than a policy binder.

APRA CPS 234 is the prudential standard that requires APRA-regulated entities — banks, insurers and superannuation funds, and their service providers — to maintain information-security capability commensurate with the threats they face. CATAAM covers CPS 234’s ten requirement areas by reusing its existing security controls — access management, security testing and incident response — and adds the standard’s APRA-specific obligations: board-level accountability, third- and related-party assurance, and the duty to notify APRA of a material incident or control weakness within 72 hours, all continuously tested to confirm they actually hold.

Evidence-gated, not checkbox

As with every framework on the platform, CATAAM does not simply store a document and mark a control “done.” Its automated tests, internal and external attack-surface management (iASM/ASM) and breach-and-attack simulation (BAS) verify that a control is actually working, and a control is credited only on confirmed, exploit-verified evidence. Where a framework shares a control with another standard, CATAAM maps it once and satisfies both — so an organization pursuing SOC 2 or ISO 27001 alongside the APPs or CPS 234 does most of the work a single time.

“Australian teams were stitching together separate tools for privacy, APRA and cyber hygiene. Now they can run the Privacy Act, CPS 234 and Essential Eight from one platform that proves the controls work — not just that a policy exists — and reuses the evidence across all of them. For a mid-market Australian business, or a fund’s service provider, that is the difference between a quarter of audit prep and a few weeks.”

Pricing and availability

The Australian Privacy Principles and APRA CPS 234 are available now to all CATAAM customers, with the same transparent, self-serve pricing as every other framework — $149 per framework, per month — and no sales call required. Plain-English explainers of both frameworks are available at https://cataam.com/blog/australian-privacy-principles-explained/ and https://cataam.com/blog/apra-cps-234-explained/.

About CATAAM

CATAAM is an all-in-one governance, risk and compliance platform that unifies automated compliance — SOC 2, ISO 27001, HIPAA, PCI-DSS, GDPR, and Australian frameworks including the Privacy Act (APPs), APRA CPS 234 and the Essential Eight — with internal and external attack-surface management (iASM/ASM) and breach-and-attack simulation (BAS) in a single product. By running its own AI models in-house, CATAAM delivers continuous, evidence-gated compliance and security at a fraction of the cost of assembling separate tools. Learn more at https://cataam.com.