pspf

Protective Security Policy Framework (PSPF)

The PSPF is the Australian Commonwealth's framework for protective security across people, information and assets. It is administered by the Attorney-General's Department (AGD). The PSPF applies to non-corporate Commonwealth entities; corporate Commonwealth entities and some other bodies may opt in or are otherwise required to apply elements of it.

The PSPF sets the agency-level governance, personnel and physical security expectations that sit alongside the ISM's technical controls. The ISM is the technical control catalogue inside the PSPF's broader policy framework.

When to use this skill

• The user is preparing for, or reporting against, the PSPF.
• The user is producing an agency security plan, threat assessment or fraud and corruption plan.
• The user is responding to a PSPF maturity self-assessment requirement.
• The user is dealing with classifications, protective markings or sensitive information handling.
• The user is engaging a contracted service provider and needs the PSPF Policy 6 governance expectations (security governance for contracted goods and services).
• The codebase or estate carries signals related to the PSPF: protective marking enforcement, classification labels in document management systems, security clearance workflows, physical access systems with a security zone model.

What this skill knows

• The PSPF's structure: four outcomes, sixteen policies under those outcomes (subject to ongoing redesign; see versions.md).
• The relationship between the PSPF and the ISM: the PSPF sets policy outcomes, the ISM provides technical controls that contribute to those outcomes.
• The role of the accountable authority (the agency head or equivalent) and the delegated Chief Security Officer (CSO).
• The classification model and protective marking standard.
• The PSPF annual reporting cycle and maturity levels.

In scope: PSPF for Commonwealth agencies up to PROTECTED. State and territory protective security regimes are out of scope.