The Australian Government’s Protective Security Policy Framework (PSPF) Released 2024 was launched on November 1, 2024. The new release is the first in an annual series that aims to improve the security of government operations.
The recent version of the PSPF sets out the Australian government’s approach over six security domains and endorses what the Australian government believes must be done to secure their individuals, data, and assets, both locally and globally. Implementing the PSPF gives the government assurance that businesses are accountable, have security protection (like a cyber incident response team), and have identified and mitigated security risks and vulnerabilities.
The PSPF provides directions and guidance for:
-
The Accountable Authorities of Australian Government entities, per the Public Governance, Performance and Accountability Act 2013 (PGPA Act).
-
Entity Chief Security Officers, Chief Information Security Officers, security advisers, and other named security officials.
-
Vendors who provide services to Australian government agencies or are required to comply with the PSPF according to relevant contracts or agreements.
-
Those responsible for communicating security information to Australian Public Service (APS) employees, vendors delivering services to Australian Government entities, and visitors to government facilities.
-
Those working inside, and for, the Australian Government, counting APS workers, third-party vendors, and contracted staff.
Read our latest post on Cracking the Code of Bulletproof Hosting: Cybercrime’s Hidden Ally
Applicability
The Directive on the Security of Government Business establishes the PSPF as Australian Government policy.
Non-corporate Commonwealth entities (entities) must apply the PSPF in accordance with section 21 of the PGPA Act.
The PSPF represents better practices for both corporate and wholly owned Commonwealth entities.
State and territory government agencies that hold or have access to sensitive and confidential Australian government information must use the PSPF to control access to that information in accordance with the plan approved between the Commonwealth, states, and territories.
Non-government organisations and third-party service providers may be required to implement aspects or parts of the PSPF. This will be detailed in relevant deeds or agreements between the Australian government and the non-government organisations or third-party service providers.
Non-government organisations may implement the PSPF as a security framework.
Accountability
The accountable authority is responsible for the implementation of the PSPF within his/her organisation and is accountable to his/her minister for the security of his/her organisation.
Compliance with the PSPF does not exempt an organisation from complying with other legal or regulatory obligations.
Reporting
Accountable Authorities must annually report compliance against the PSPF to both their minister and the Department of Home Affairs.
These reports assure the government that entities are implementing sound and responsible protective security practices and identifying and mitigating security risks and vulnerabilities through vulnerability assessment.
The Department of Home Affairs will undertake quality assurance of submitted reports. Information about this activity can be found in Protective Security Reporting Quality Assurance.
Also, read Why Australian Businesses Must Prioritize Compliance with the Privacy Act and SOCI
Six Security Domains of the PSPF
-
Security Governance: Ensures agencies implement appropriate security controls and report compliance to maintain accountability.
-
Establishing robust security governance structures.
-
Implementing risk-based security approaches.
-
Ensuring leadership accountability for security measures.
-
Information Security: Protects government data from unauthorised access, manipulation, or loss, including cybersecurity measures.
-
Protecting government data from cyber threats, unauthorised access, and breaches.
-
Strengthening controls for classified and sensitive information by hiring wireless cyber security penetration auditors.
-
Enhancing cybersecurity resilience through technology and policies.
-
Personnel Security: Establishes security clearances and background checks to ensure trusted individuals handle sensitive information.
-
Conducting background checks and security clearances for government personnel.
-
Managing insider threats and preventing unauthorised access to sensitive information.
-
Ensuring security awareness training for employees.
-
Physical Security: Implements measures to protect government assets and facilities from physical threats.
-
Protecting government facilities, critical infrastructure, and assets from physical threats.
-
Implementing access control measures and surveillance systems.
-
Ensuring business continuity in case of security incidents.
-
Supply Chain Security: Assesses and mitigates risks associated with third-party providers and external suppliers.
-
Assessing and mitigating risks from third-party service providers.
-
Implementing security controls for contractors and vendors handling sensitive government information.
-
Preventing foreign interference and data leaks.
-
Emerging Threats: Addresses modern challenges like cyber threats, foreign interference, and security of emerging technologies.
-
Addressing risks from evolving threats such as cybercrime, espionage, and terrorism.
-
Strengthening preparedness against global and domestic security challenges.
-
Enhancing collaboration between agencies and private sector partners to improve national security resilience.
Key Enhancements in PSPF Release 2024:
-
Expanded Security Domains: The framework now encompasses six distinct security domains, including new areas focused on risk and technology, to address contemporary threats comprehensively.
-
Addressing Modern Threats: Incorporation of requirements to manage current protective security challenges, such as supply chain security, third-party risk management, foreign interference, and the security of operational and emerging technologies.
-
Improved Accessibility and Structure: The PSPF has been restructured for better clarity, making it more user-friendly for entities to implement the prescribed security measures.
-
Clear Guidance on Implementation: Provision of explicit guidance to address areas with previously low maturity or ambiguity, facilitating more effective compliance.
-
Transition to Compliance Reporting: A shift from a maturity-based to a compliance-based reporting model ensures more accurate data collection and enables a thorough analysis of security vulnerabilities.
Importance of PSPF
For government entities, compliance with the PSPF ensures a robust security posture, protecting national interests from cyber threats, espionage, and physical security breaches. Private organisations working with government agencies must also align with PSPF guidelines to ensure seamless security integration.
Build a shield to protect your networks and devices before it’s too late. Let Cybernetic Global Intelligence help you secure systems and networks with the best cybersecurity experts in the country. Call us now at 1300 292 376 or email us at contact@cybernetic-gi.com.