How much does IT support cost for finance companies?

APRA's CPS 234 information security standard requires APRA-regulated entities, banks, insurers, superannuation funds and their related bodies, to maintain information security capability, and that obligation flows through to any third party they engage, including a managed IT provider. An APRA-regulated business cannot simply hire the cheapest MSP; its provider must be able to participate in formal third-party risk assessments and provide evidence of its own information security programme on request.

A finance business that is not itself APRA-regulated, many fintechs, brokers and advisory firms, faces a lighter compliance load and can reasonably sit in a general managed-IT band. A business that is APRA-regulated is, in practice, expected to run 24/7 managed detection and response and demonstrate its provider's own compliance capability, which is why Australian rate cards show a real jump in price between the two.

CPS 230 (operational risk) obligations layer on top of CPS 234 for many of the same entities, and providers factor documentation, audit trails and incident-response planning into their pricing accordingly rather than treating them as optional add-ons.

CPS 234 does not stop at the regulated entity's own walls. It explicitly requires an APRA-regulated business to assess and manage the information security capability of any third party it engages, including a managed IT provider, and to notify APRA of material information security incidents. In practice this means an APRA-regulated business cannot simply hire the cheapest available MSP, its provider must be willing and able to participate in formal third-party risk assessments, supply evidence of its own information security programme, and contractually commit to standards aligned with the regulated entity's own CPS 234 obligations.

That requirement changes what a provider actually delivers, not just how it is priced. A provider serving APRA-regulated clients typically maintains its own documented security programme, staff who understand the assessment process, and the administrative capacity to respond to a client's regulator-driven audit request within a reasonable timeframe. Providers without this capability are effectively unable to serve this segment at all, regardless of price, which is part of why the regulated tier commands a genuine premium rather than simply reflecting more expensive tools.

One published 2026 Australian source gives a direct worked example for a 100-staff financial-services business requiring APRA CPS 234 alignment and managed detection and response: $20,000 to $32,000 a month, equivalent to $200 to $320 per user. That figure sits at the top of this guide's own table because it describes exactly the regulated case the top row is scoped to, not a general small-business estimate.

A separate source, focused on accounting and advisory practices that service APRA-regulated clients without being directly regulated themselves, shows a lower band: from $700 to $2,000 a month for a small practice up to $8,000 to $18,000 or more a month for a large one, or $79 to $220 per user depending on size. That is the source for this guide's first two rows, and it is a genuinely different case from direct APRA regulation, which is why the guide separates them rather than presenting one blended number.

Both sources agree on the underlying pattern even though they describe different populations: cost rises with regulatory obligation, not simply with headcount, and a small directly-regulated entity can cost more to support than a much larger business with no APRA exposure at all.

Direct APRA regulation is the single biggest driver, for the reasons above, and it is worth confirming explicitly with a provider rather than assumed from business size.

Coverage hours matter second. Business-hours-only support sits at the bottom of a tier; 24/7 managed detection and response, effectively mandatory for an APRA-regulated entity, is the biggest single driver of moving to the top tier.

Third-party risk assessment capability matters third. An APRA-regulated business needs a provider that can itself pass a formal security assessment and supply evidence on request, and providers who can do this price for the additional documentation and audit overhead involved.

CPS 230 operational-risk documentation matters fourth, layering on top of CPS 234 for many of the same entities and adding its own business-continuity and incident-response planning overhead.

Headcount and site count matter fifth, in the same direction as general IT support: smaller businesses typically sit nearer the top of a tier's per-user range, and multi-office networking adds cost within any tier.