The Protective Security Policy Framework (PSPF) helps Australian Government entities to protect their people, information and assets, both at home and overseas. It sets out government protective security policy and supports entities to effectively implement the policy across the following outcomes: security governance information security personnel security physical security.
Showing 51 controls
6.1
Each entity is accountable for the security risks arising from procuring goods and services, and must ensure contracted providers comply with relevant PSPF requirements.
9.1
Each entity must enable appropriate access to official information. This includes:
9.1.a
sharing information within the entity, as well as with other relevant stakeholders.
9.1.b
ensuring that those who access sensitive or security classified information have an appropriate security clearance and need to know that information.
9.1.c
controlling access to supporting ICT systems, networks (including remote access), infrastructure and applications.
12.1
Each entity must ensure the eligibility and suitability of its personnel who have access to Australian Government resources (people, information and assets).
12.2
Entities must use the Australian Government Security Vetting Agency (AGSVA) to conduct vetting, or where authorised, conduct security vetting in a manner consistent with the Personnel Security Vetting...
13.1
Each entity must assess and manage the ongoing suitability of its personnel and share relevant information of security concern, where appropriate.
2.1.a
appoint a Chief Security Officer (CSO) at the Senior Executive Service level to be responsible for security in the entity.
2.1.b.i
appointing security advisors within the entity.
2.1.b.ii
the entity's protective security planning.
2.1.b.iii
the entity's protective security practices and procedures.
2.1.b.iv
investigating, responding to, and reporting on security incidents.
2.1.c
ensure personnel and contractors are aware of their collective responsibility to foster a positive security culture, and are provided sufficient information and training to support this.
15.1.a
harm to people
15.1.b
information and physical asset resources being made inoperable or inaccessible, or being accessed, used or removed without appropriate authorisation.
16.1.a
ensure it fully integrates protective security in the process of planning, selecting, designing and modifying its facilities for the protection of people, information and physical assets.
16.1.b
in areas where sensitive or security classified information and assets are used, transmitted, stored or discussed, certify its facility’s physical security zones in accordance with the applicable ASIO...
16.1.c
accredit its security zones.
5.1.a.i
whether the entity achieved security outcomes through effectively implementing and managing requirements under the PSPF.
5.1.a.ii
the maturity of the entity’s security capability.
5.1.a.iii
key risks to the entity’s people, information and assets.
5.1.a.iv
details of measures taken to mitigate or otherwise manage identified security risks.
5.1.b
to affected entities whose interests or security arrangements could be affected by the outcome of unmitigated security risks, security incidents or vulnerabilities in PSPF implementation
5.1.c
to the Australian Signals Directorate in relation to cyber security matters.
11.1
Each entity must ensure the secure operation of their ICT systemsto safeguard information and the continuous delivery of government business by applying the Australian Government Information Security...
1.1
The accountable authority is answerable to their minister and the government for the security of their entity.
1.2.a
determine their entity's tolerance for security risks.
1.2.b
manage the security risks of their entity.
1.2.c
consider the implications their risk management decisions have for other entities, and share information on risks where appropriate.
1.3.a
provide other entities with advice, guidance and services related to government security.
1.3.b
ensure that the security support it provides helps relevant entities achieve and maintain an acceptable level of security.
1.3.c
establish and document responsibilities and accountabilities for partnerships or security service arrangements with other entities.
10.1.a.i
Application control
10.1.a.ii
Patching applications
10.1.a.iii
Restricting administrative privileges
10.1.a.iv
Patching operating systems
10.1.b
considering which of the remaining mitigations strategies from the Strategies to Mitigate Cyber Security Incidents you need to implement to protect your entity.
7.1
Each entity must adhere to any provisions concerning the security of people, information and assets contained in international agreements and arrangements to which Australia is a party.
4.1
Each entity must assess the maturity of its security capability and risk culture by considering its progress against the goals and strategic objectives identified in its security plan.
3.1
Each entity must have in place a security plan approved by the accountable authority to manage the entity’s security risks. The security plan details:
3.1.a
the security goals and strategic objectives of the entity, including how security risk management intersects with and supports broader business objectives and priorities.
3.1.b
the threats, risks and vulnerabilities that impact the protection of an entity’s people, information and assets.
3.1.c
the entity’s tolerance to security risks.
3.1.d
the maturity of the entity’s capability to manage security risks.
3.1.e
the entity’s strategies to implement security risk management, maintain a positive risk culture and deliver against the PSPF
8.1.a
identify information asset holdings.
8.1.b
assess the sensitivity and security classification of information asset holdings.
8.1.c
implement operational controls for these assets proportional to their value, importance and sensitivity.
14.1.a
have their access to Australian Government resources withdrawn.
14.1.b
are informed of any ongoing security obligations.