Security governance
Set accountabilities, reporting and a risk-based approach to protective security.
Australia · Attorney-General's Department · PSPF
Protective Security Policy Framework
The framework for how Commonwealth entities protect people, information and assets from insider and external threats.
What it is
The PSPF is the Australian Government's protective security policy. It sets requirements across four outcomes: governance, information, personnel and physical security. For cybersecurity, non-corporate Commonwealth entities must apply the ACSC's ISM controls and the Essential Eight. Each entity's Accountable Authority attests to compliance every year.
Who it applies to
Mandatory for non-corporate Commonwealth entities. Corporate Commonwealth entities and state/territory agencies use it as good-practice guidance.
Requirements
Information security
Classify official information, then protect and share it based on sensitivity and business impact.
Personnel security
Vet personnel, manage insider risk, and check they stay suitable for classified access.
Physical security
Protect people, information and physical assets based on business impact levels and threat.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.