Protective Security Policy Framework (PSPF) Compliance

Overview

The PSPF is the Australian Government's mandatory protective security framework, setting out the requirements that Commonwealth entities must meet to protect their people, information, and assets. It provides a comprehensive, risk-based approach that integrates governance, information, personnel, physical, and cyber security.

The framework is structured around a series of policies that define mandatory requirements across each security domain. Entities must implement these requirements proportionate to their risk profile and report on their maturity annually. The entity head is ultimately accountable for ensuring compliance.

Information security under the PSPF includes the Australian Government's classification scheme, which defines how information is classified, handled, stored, and transmitted. Cyber security requirements are met through alignment with the ASD ISM and the Essential Eight mitigation strategies.

The PSPF is reviewed and updated by the Attorney-General's Department to reflect evolving threats and changes in government policy. Entities must monitor updates and adjust their security practices accordingly to maintain compliance and effective protection.

Key Areas

• Security governance - leadership, planning, and risk management
• Information security - classification, handling, and protection of government information
• Personnel security - eligibility and suitability of people accessing government resources
• Physical security - protection of facilities, assets, and sensitive areas
• Cyber security - protection of information in digital systems (aligned with ASD ISM)
• Security maturity - self-assessment and continuous improvement
• Investigation and reporting - security incidents and investigations
• International security obligations and information sharing

Who It's For

• Non-corporate Commonwealth Government entities (mandatory)
• Corporate Commonwealth entities (voluntary adoption recommended)
• Chief Security Officers and their protective security teams
• Government employees and contractors with access to government information and assets

Core Requirements

Policies and Governance

Entities must appoint a Chief Security Officer, develop a security plan, and establish governance arrangements that integrate protective security into entity-wide risk management. The entity head is responsible for ensuring PSPF requirements are met.

Risk Management

Entities must conduct security risk assessments that consider threats to people, information, and assets. Risk treatments must be proportionate, documented, and subject to ongoing review. Residual risks must be accepted at the appropriate level of authority.

Security Controls

Controls must address information security (classification, handling, access), personnel security (eligibility, suitability, ongoing management), physical security (facilities, zones, access controls), and cyber security (aligned with the ASD ISM and Essential Eight).

Incident Response

Entities must have procedures for detecting, reporting, and investigating security incidents across all domains. Incidents involving compromise of classified information must be reported to relevant authorities. Incident response must be tested and reviewed.

Evidence and Reporting

Entities must conduct annual self-assessments of their maturity against PSPF requirements and report results. Evidence includes security plans, risk assessments, incident reports, training records, and physical security assessments.

Implementation Steps

1. Scope and objectives - Identify all people, information, and assets that require protective security. Classify information according to the PSPF classification scheme. Define the entity's security risk profile and set maturity improvement objectives.
2. Gap assessment - Assess current protective security practices across governance, information security, personnel security, physical security, and cyber security against PSPF requirements. Identify gaps and prioritise remediation.
3. Control implementation - Implement protective security measures across all PSPF domains. This includes establishing governance structures, implementing information handling procedures, conducting personnel security vetting, securing facilities, and deploying cyber security controls.
4. Evidence and documentation - Develop and maintain the entity security plan. Document risk assessments, control implementations, personnel vetting records, facility security assessments, and incident management procedures. Prepare evidence for annual self-assessment.
5. Review and continuous improvement - Conduct annual self-assessments against PSPF requirements and report maturity levels. Review and update the security plan based on assessment outcomes, security incidents, and changes to the threat environment. Pursue continuous improvement in security maturity.

Frequently Asked Questions

Who must comply with the PSPF?

Non-corporate Commonwealth entities are required to comply. Corporate Commonwealth entities and state/territory governments are encouraged to adopt the framework.

What does the PSPF cover?

The PSPF covers four domains: security governance, information security, personnel security, and physical security. Cyber security is addressed in alignment with the ASD ISM.

How is compliance assessed?

Entities conduct annual self-assessments of their maturity against PSPF requirements and report results to their responsible minister and to central oversight bodies.

What is the relationship between the PSPF and the ISM?

The PSPF provides the overarching protective security framework. The ASD ISM provides the detailed cybersecurity controls that entities implement to meet the PSPF's information and cyber security requirements.

Does the PSPF include a maturity model?

Yes. Entities self-assess across maturity levels for each PSPF requirement, ranging from ad hoc practices through to optimised, risk-based approaches.

Who is the Chief Security Officer?

Each entity must appoint a Chief Security Officer (CSO) responsible for overseeing the entity's protective security. The CSO reports to the entity head on security matters.

How does the PSPF handle classified information?

The PSPF establishes the classification scheme for Australian Government information (OFFICIAL, PROTECTED, SECRET, TOP SECRET) and sets requirements for handling, storing, and transmitting information at each level.

Why It Matters

• The PSPF provides the foundational security framework for the Australian Government, ensuring consistent protection of people, information, and assets across all Commonwealth entities. Without such a framework, individual entities might adopt inconsistent or inadequate security measures, creating vulnerabilities across the government.
• By integrating governance, information, personnel, and physical security into a single framework, the PSPF ensures that entities take a holistic approach to protective security. This prevents siloed security programs that might address one aspect of security while leaving others exposed.
• The framework's risk-based approach ensures that protective security measures are proportionate and efficient. Entities focus their resources on the areas of greatest risk rather than applying uniform controls regardless of the sensitivity or criticality of what they are protecting.

Common Challenges

• Managing protective security across all four domains (governance, information, personnel, physical) simultaneously
• Ensuring consistent classification and handling of information across large, distributed entities
• Completing personnel security vetting within acceptable timeframes given demand for clearances
• Maintaining physical security for geographically dispersed facilities and co-located environments
• Integrating PSPF requirements with cyber security obligations under the ASD ISM
• Achieving meaningful self-assessment outcomes rather than compliance-oriented checkbox exercises
• Sustaining security culture and awareness across large, diverse workforces