PSPF Implementation & Compliance

What it is

Support for Australian Government organisations and contractors to understand, implement, and maintain compliance with the Protective Security Policy Framework (PSPF). We help you establish security zones, implement protective measures, and demonstrate compliance with government security requirements.

Our process

  • You are a government agency or contractor required to comply with PSPF

  • You are tendering for government work and need to demonstrate security capability

  • You are establishing or upgrading security zones to protect classified or sensitive information

  • You need to understand PSPF requirements and how they apply to your organisation

  • You are preparing for a security compliance audit or government inspection

  • You are designing a new facility or site and need to incorporate PSPF requirements from the outset

  • You need to train staff on PSPF principles and protective security obligations

What you will receive

  • Clear explanation of PSPF requirements relevant to your organisation and security classification level

  • Security zone design and layout recommendations aligned to PSPF standards

  • Protective measures plan detailing physical, procedural, and human security controls

  • Gap analysis comparing your current state to PSPF requirements

  • Implementation roadmap with prioritised actions and timelines

  • Staff training materials and briefings on PSPF obligations

  • Ongoing support for compliance monitoring and updates

Our Process

  1. PSPF requirements review: We clarify which PSPF obligations apply to your organisation, based on your security classification level and information handling requirements

  2. Current state assessment: We evaluate your existing security controls, policies, and procedures against PSPF standards

  3. Gap analysis: We identify where your current arrangements do not meet PSPF requirements

  4. Security zone design: We recommend security zone classifications and protective measures appropriate to your facility and information sensitivity

  5. Protective measures planning: We develop detailed recommendations for physical security, access control, information handling, personnel security, and incident response

  6. Implementation roadmap: We prioritise actions, identify resource requirements, and establish timelines for compliance

  7. Staff training and communication: We develop training materials and conduct briefings to ensure staff understand PSPF obligations and their role in compliance

  8. Ongoing compliance support: We provide guidance on maintaining compliance, responding to security incidents, and updating procedures as requirements change

Standards and frameworks we consider

  • Australian Government Protective Security Policy Framework (PSPF) — The mandatory security policy for protecting classified and sensitive government information

  • PSPF Security Zones — Classification system defining protective measures for different information sensitivity levels

  • ISO 31000 — Risk management principles applied to PSPF compliance

Frequently asked questions

  1. What is PSPF and who needs to comply? PSPF is the Australian Government’s mandatory security policy for protecting classified and sensitive information. Compliance is required for government agencies and contractors handling government information. Increasingly, critical infrastructure operators and other organisations adopt PSPF principles as best practice.

  2. What are security zones? Security zones are defined areas where access is controlled and protective measures are applied consistently. PSPF defines security zone classifications based on the sensitivity of information and assets. Each zone has specific requirements for physical security, access control, and information handling.

  3. How do I know which PSPF requirements apply to my organisation? Your PSPF obligations depend on your security classification level (Unclassified, Protected, Confidential, Secret, Top Secret) and the types of information you handle. We help you determine your classification level and the specific requirements that apply.

  4. What is the difference between PSPF and ISO 31000? ISO 31000 is a general risk management framework. PSPF applies ISO 31000 principles specifically to government security. We use both frameworks to ensure your security approach is both compliant and proportionate to your risk.

  5. How long does PSPF implementation take? Implementation timelines vary depending on your current state and the complexity of your organisation. A small organisation with basic requirements might achieve compliance in 3–6 months. Larger organisations with complex information handling may require 12 months or more. We work with you to establish a realistic timeline.

  6. Can you help us with government tenders that require PSPF compliance? Yes. We can help you understand tender requirements, develop a compliance plan, and demonstrate your security capability to government buyers. We can also provide references and evidence of PSPF compliance.

  7. What happens if we do not comply with PSPF? Non-compliance can result in loss of government contracts, security incidents, regulatory action, and reputational damage. Government agencies may suspend or terminate contracts with non-compliant contractors. We help you avoid these risks through proactive compliance.

Related services