Home/Industries/Financial services
Industries — Financial servicesCloud your regulator will accept.
APRA-regulated entities do not get to treat a service provider as somebody else's problem. We work as a material service provider that expects to be documented, assessed and tested.
What actually lands on you, and where we help
This is a summary of how the obligations translate into engineering work. It is not legal or regulatory advice — your risk and compliance functions own the interpretation.
| Obligation | Engineering translation |
|---|---|
| CPS 234 — information security capability | Demonstrable controls proportionate to threat, tested regularly, with evidence retained and incidents notifiable to APRA |
| CPS 234 — third-party assurance | You must assess our controls, not accept assertions. We provide control mapping, test results and access to evidence |
| CPS 230 — critical operations | Tolerance levels defined per critical operation, and resilience demonstrated against them — which means tested failover, not a document |
| CPS 230 — service provider management | Material arrangement register, contractual rights of audit and termination, and a documented exit plan that has been thought through |
| Data sovereignty | Workloads and backups in Australian regions; sub-processor locations disclosed and controlled |
What we provide as a service provider
- Control mapping against CPS 234 with test evidence
- Right-of-audit clauses accepted as standard, not negotiated as an exception
- Incident notification path aligned to your APRA obligations, with agreed timeframes
- Sub-processor register with hosting locations and change notice
- Documented exit plan and handover pack, kept current rather than written at signing
- Annual resilience testing with written results you can put in front of an assessor
Our 30-day exit clause and everything-in-your-repository model exist partly because concentration risk and exit feasibility are exactly what CPS 230 asks you to demonstrate.
What financial services customers ask us for
Resilience evidence
Tolerance levels translated into RTO/RPO per critical operation, backup and multi-region strategy rebuilt to match, then a live failover exercise with a timed written result.
Landing zone remediation
Control Tower, SCPs, permission boundaries and immutable audit logging retro-fitted to an estate that grew organically before governance arrived.
Core system migration
Wave-planned migration with rehearsed cutovers and rollback triggers, sequenced around reporting periods and regulatory deadlines.
Data segregation review
Who can read what, provable in an audit — Lake Formation permissions, key separation, and access logs held outside the accounts being audited.
Cost attribution
Spend allocated to product lines and business units for internal cost recovery, with unit economics where the business needs cost per account or per transaction.
Assessor support
Sitting in the room for internal audit and external assessment, answering the technical questions with the evidence already assembled.
Why we make ourselves easy to replace
CPS 230 asks you to understand what happens if a material service provider fails or has to be exited. Most MSP arrangements make that question uncomfortable to answer: the infrastructure code lives in the provider's repository, the runbooks are in their wiki, and the monitoring is in their tenancy.
We build the other way. Your Terraform, your pipelines, your dashboards, your documentation — all in your accounts and repositories from day one, with a 30-day exit clause and a handover pack we keep current. It costs us leverage. It is also the honest answer to the question your board will eventually ask.
How we workQuestions worth asking any cloud MSP
- Where does our infrastructure code live, and who can read it?
- If we terminated today, what would we not be able to operate on Monday?
- Will you accept a right of audit, and have you been audited before?
- What is your sub-processor list, and where do they host?
- Show me the written result of your last customer failover test.
We are happy to answer all five in a first meeting. So should anyone else you are considering.
Bring your risk function to the first call
It saves a round trip, and the questions they ask are the ones that determine whether an arrangement is workable.