Industry Insights · Government information · 9 min read

What Is the PSPF? The Protective Security Policy Framework Explained

The PSPF is the Australian Government's protective security policy. Learn who must apply it, its six domains, classifications and how it relates to the ISM.

If your agency handles Australian Government information, or your company supplies one, the Protective Security Policy Framework sets the security rules your work is measured against. It decides how information is classified, who may access it and what agencies must report each year.

This guide uses PSPF Release 2026, which the Department of Home Affairs issued on 1 July 2026.

What is the Protective Security Policy Framework (PSPF)?

The Protective Security Policy Framework (PSPF) is the Australian Government's protective security policy. Administered by the Department of Home Affairs, it sets the minimum requirements that non-corporate Commonwealth entities must apply to protect their people, information and resources, at home and overseas, across six security domains: governance, risk, information, technology, personnel and physical.

Through the Directive on the Security of Government Business, the Minister for Home Affairs directs the Accountable Authorities of non-corporate Commonwealth entities to comply with the PSPF. Home Affairs reviews the framework every year, consulting entities through the Government Security Committee, and publishes an annual release. PSPF Release 2024 was the first in that series.

How the PSPF is structured

PSPF Release 2026 has five tiers:

Principles: apply to every aspect of protective security.
Domains: six interconnected subject areas.
Policy: mandatory requirements, each with a permanent number such as Requirement 0059.
Standards and technical manuals: more detailed mandatory requirements on specific topics, such as email protective markings.
Guidelines: best practice implementation advice.

The six security domains

Release 2026 sets numbered requirements across six domains. Risk and technology became separate domains in PSPF Release 2024.

Governance: security roles, planning, incidents, training and annual reporting.
Risk: security and third-party risk, foreign interference and espionage, and contingency planning.
Information: classifications and caveats, information holdings, disposal and sharing.
Technology: technology lifecycle management, cyber security strategies (including the Essential Eight) and programs.
Personnel: pre-employment screening, access to resources, security clearances, vetting and separation.
Physical: facilities, security zones and physical security measures.

PSPF security classifications

The originator of official information assigns a classification by assessing the damage that would follow if its confidentiality were compromised, and must set it at the lowest reasonable level. PSPF Release 2026 uses four security classifications, each matched to a business impact level (BIL):

OFFICIAL: Sensitive (BIL 2): limited damage to an individual, organization or government.
PROTECTED (BIL 3): damage to the national interest, organizations or individuals.
SECRET (BIL 4): serious damage to the national interest, organizations or individuals.
TOP SECRET (BIL 5): exceptionally grave damage to the national interest, organizations or individuals.

Routine government information is treated as OFFICIAL (BIL 1), which is not a security classification or a mandatory marking. Our guide to OFFICIAL: Sensitive explains how the lowest classification is handled.

Annual reporting and maturity

The Accountable Authority of each non-corporate Commonwealth entity must report on PSPF compliance every year, to its minister and to Home Affairs, and must approve the report after verifying its content.

PSPF Release 2024 shifted reporting from a maturity model to a compliance model. Before 1 November 2024, entities self-assessed against the PSPF Maturity Self-Assessment Model. Now each requirement equates to a question in the annual report, with a reporting type of performance, yes/no, or yes/no/not applicable. For the 2024-25 reporting period, 100 non-corporate Commonwealth entities submitted reports.

Maturity still appears in the requirements. Each entity's security plan must describe the maturity of its capability to manage security risks, and Requirements 0099 to 0106 require all eight Essential Eight strategies to be implemented to Maturity Level Two.

How the PSPF relates to the ISM

The PSPF sets policy across all six domains. The Information Security Manual (ISM), published and regularly updated by the Australian Signals Directorate (ASD), provides the cyber security principles and controls for information technology and operational technology systems.

PSPF Requirement 0084 requires entities to apply the ISM's cyber security principles at every stage of each system's lifecycle, and Requirement 0085 requires its controls and guidelines to be applied on a risk-based approach. Each system must be authorized to operate, based on the ISM's risk-based approach, before it handles government information. Cloud service providers must have completed an IRAP assessment against the latest ISM within the previous 24 months (Requirement 0109).

PSPF vs ISM vs Essential Eight

	PSPF	ISM	Essential Eight
Published by	Department of Home Affairs	Australian Signals Directorate (ASD)	Australian Signals Directorate (ASD)
What it covers	Protective security policy across six domains, from governance to physical security	Cyber security principles and controls for information technology and operational technology systems	Eight mitigation strategies designed to protect internet-connected IT networks
Who must apply it	Non-corporate Commonwealth entities; suppliers as their contracts specify	Non-corporate Commonwealth entities, under PSPF Requirements 0084 and 0085; voluntary for others unless legislation or a direction requires it	Non-corporate Commonwealth entities, to Maturity Level Two; others choose a target level
Output	An annual protective security report to the minister and Home Affairs	An authorization to operate decision, supported by a security assessment report	A maturity level, from Zero to Three
Current version	PSPF Release 2026 (1 July 2026)	ISM September 2026	Essential Eight Maturity Model, November 2023

ASD explains the strategies and maturity levels on its Essential Eight page.

Does the PSPF apply to your organization?

Non-corporate Commonwealth entities must apply the PSPF, in accordance with section 21 of the Public Governance, Performance and Accountability Act 2013 (PGPA Act).
Corporate Commonwealth entities and wholly owned Commonwealth companies are not required to apply it, but it represents better practice for them.
State and territory agencies that hold or access Australian Government security classified information must apply the PSPF to regulate access to it, under arrangements agreed between the Commonwealth, states and territories.
Suppliers and other non-government organizations must implement the parts set out in their deeds or agreements, and may adopt it voluntarily.

For suppliers, the obligations arrive through procurement. Requirement 0040 requires contracts to contain proportionate security terms, and Requirement 0077 requires an agreement setting handling requirements before an entity shares security classified information outside government. Requirement 0111 requires security classified information to be hosted with a service certified under the Hosting Certification Framework or the new Hosting Certification Framework 2. Read the full release on the PSPF annual release page.

Where DekkoCORE fits

DekkoCORE is IRAP assessed for Australian government information up to PROTECTED, and for Australian customers it is hosted in-country, in Australia. Files can be marked OFFICIAL, OFFICIAL: Sensitive or PROTECTED, each person you share with gets the permission level you choose, and every view and download is recorded in the audit log. See the DekkoCORE security and compliance page for details.

Common questions

Frequently Asked Questions

Is the PSPF mandatory?

The PSPF is mandatory for non-corporate Commonwealth entities, which must apply it under section 21 of the PGPA Act. The PSPF is better practice for corporate Commonwealth entities and wholly owned Commonwealth companies. Suppliers must follow the parts of the PSPF written into their contracts or deeds.

What changed in PSPF Release 2026?

PSPF Release 2026, issued on 1 July 2026, introduced policy improvements covering post-quantum cryptography transition planning, training on AI use and bring-your-own-device obligations. Release 2026 also strengthened restrictions on personnel posting security clearance information online.

How many domains are in the PSPF?

The PSPF has six security domains: governance, risk, information, technology, personnel and physical. The PSPF treats the domains as interconnected, so entities must plan security across all six. Risk and technology became separate domains in PSPF Release 2024.

What is the difference between the PSPF and the ISM?

The PSPF is the Australian Government's protective security policy, administered by the Department of Home Affairs across six domains. The ISM is the Australian Signals Directorate's framework of cyber security principles and controls for technology systems. The PSPF requires non-corporate Commonwealth entities to apply the ISM.

Do contractors have to comply with the PSPF?

Contractors and suppliers must comply with the PSPF requirements set out in their contracts, deeds or agreements. PSPF Release 2026 requires entities to include proportionate security terms in procurement and outsourcing arrangements and to ensure service providers, contractors and subcontractors comply with the PSPF requirements the entity specifies.