Protective Security Policy Framework (PSPF) Compliance

Learn how Fortra’s suite of integrated security solutions empower Australian Government entities to consistently and effectively meet PSPF requirements.

READ DATASHEET REQUEST A DEMO

Challenges of Protective Security Policy Framework Compliance

The Protective Security Policy Framework (PSPF) sets the standard for how government entities protect their people, information, and resources. The Australian Attorney-General’s Department (AGD) maintains and amends the framework, while Accountable Authorities and the Department of Home Affairs oversee compliance for individual entities and monitor government-wide compliance, respectively.

The Protective Security Policy Framework is just that — a framework. But even so, the consequences of non-compliance range from operational disruptions to preventable security incidents, reputational damage, and even legal liability in the wake of a breach. With that in mind, however, government entities often run into common challenges in their compliance efforts, including:

Fragmented Visibility

Inconsistent Markings & Classification

Disconnected Security Controls

Reporting & Accountability Burdens

Expanding Attack Surface

The PSPF sets out Australian Government policy across six security domains: Governance, Risk, Information Security, Technology Security, Personnel Security, and Physical Security. While sheer awareness and organizational buy-in are significant contributors to PSPF compliance, meeting specific requirements outlined by the PSPF demands solutions that enhance government entities’ visibility, policy enforcement, and reporting capabilities. Fortra’s suite of defensive security solutions gives Australian Government entities the operational capacity to enforce PSPF controls consistently, demonstrate compliance, and close the gap between policy and real-world practice.

Fortra's Solutions for PSPF Compliance

For Australian Government entities and their service providers, meeting Protective Security Policy Framework (PSPF) requirements isn’t a matter of checking boxes — it demands an active, continuously managed security program. Among the PSPF’s six security domains, the Information and Technology domains are where most entities often feel the operational pressure most acutely.

Fortra’s integrated portfolio of defensive security solutions is purpose-built to address common PSPF challenges, giving entities the capabilities needed to facilitate PSPF compliance across these domains.

Our foundational PSPF compliance solutions include:

Data Classification

Fortra Data Classification enables users to apply flexible, PSPF-relevant classification markings — from ‘Official’ to ‘Top Secret’ — across Microsoft 365, Outlook, and Windows. Persistent metadata tags travel with the data, driving downstream enforcement across DSPM, DLP, email security, and beyond.

Email Security

Fortra Email Security layers cloud email protection, DMARC management, phishing defense, and more to secure what is likely your entity's most-used communication channel. Integrated with Fortra Data Classification, it ensures classified emails are routed and handled in line with PSPF’s Email Protective Marking Standard.

Data Security Posture Management

Fortra DSPM continuously discovers and inventories sensitive data across your cloud environment, automatically applying classification labels and identifying misconfigurations, excessive access, and shadow data. In turn, your security team is granted greater visibility and granular controls, allowing them to align access controls with the PSPF’s need-to-know principle.

How Fortra’s Solutions Address PSPF Requirements

To protect people, information, and resources up to the standards of the Australian government, the PSPF mandates several precautions and ongoing security practices, many of which can be facilitated by Fortra’s integrated data security solutions:

Section 9.2 – Security Classifications

Entities must assess all official information against the Australian Government’s classification framework and assign the appropriate security classification (‘Official: Sensitive’, ‘Protected’, ‘Secret’, or ‘Top Secret’) at the lowest reasonable level, based on the potential damage its compromise would cause.

How Fortra Helps

  • Fortra Data Classification enables users to apply PSPF-aligned classification markings directly within Microsoft 365, Outlook, and Windows
  • User-guided classification prompts help personnel make accurate classification decisions at the point of content creation
  • Persistent classification labels ensure the correct marking travels with the document throughout its lifecycle, regardless of where it is stored or shared
  • Fortra DSPM automatically identifies and classifies sensitive data discovered across cloud and hybrid environments, reducing the risk of unclassified or misclassified information holdings

Data bg

Featured Resource

The Protective Security Policy Framework - Protecting Government Classified Information 

 

READ THE GUIDE

Fortra Closes the Gap Between PSPF Requirements and Real-World Practice

Whether you’re conducting a gap assessment, preparing for annual PSPF reporting, or building a zero-trust architecture from the ground up, Fortra’s experts and integrated solutions are here to help. Talk to a Fortra expert today.

 

REQUEST A DEMO

FAQ

The PSPF applies to all non-corporate Commonwealth entities and corporate Commonwealth entities listed under the Public Governance, Performance and Accountability Act 2013 (PGPA Act). It also applies to service providers that deliver services to Australian Government entities under relevant deeds or agreements.

Accountable Authorities are ultimately responsible for their entity’s compliance posture. CSOs own protective security across the entire entity (often both digital and physical), while CISOs take specific responsibility for the entity’s cybersecurity strategy, ISM implementation, and the Essential Eight. In practice, this means that compliance with the PSPF’s information and technology domains requires tools that security teams can deploy, configure, and report on.

The PSPF, ISM, and Essential Eight are complementary and mutually reinforcing. The PSPF sets the policy requirements; the ISM provides the technical controls that operationalize them; and the Essential Eight defines the eight highest-priority mitigation strategies that entities must implement. PSPF Release 2025 explicitly mandates that entities implement the Essential Eight to Maturity Level Two and align their cybersecurity strategy with both the ISM and ASD’s Guiding Principles to embed a zero trust culture.

Zero trust is a significant focus of the 2025 update. PSPF Release 2025 requires entities to embed a zero trust culture through a set of guiding principles, meaning that zero trust is now an organizational requirement as opposed to a technology architecture choice. The principle that no user, device, or application should be implicitly trusted must be reflected in an entity’s access controls, ongoing monitoring practices, and greater cybersecurity strategy.

A PSPF gap assessment typically involves mapping an entity’s current security controls against PSPF requirements across each of the six security domains, identifying areas where controls are absent, insufficient, or not yet implemented, and prioritizing remediation based on risk. Entities often engage an IRAP-accredited assessor for independent assurance. From a technology standpoint, solutions like Fortra DSPM and Vulnerability Management can surface visibility gaps and configuration weaknesses that a gap assessment would flag, giving security teams a head start before a formal review.

Because the PSPF spans six security domains and dozens of individual requirements, most entities approach implementation in phases rather than attempting to address everything at once, particularly when starting from the ground up. A common approach is to begin with the information and technology/ICT domains, where the operational impact of gaps is most immediately felt, before moving to governance, personnel, and physical security programs. Within the technology domain, foundational capabilities like visibility (via DSPM) and data classification are often deployed first, followed by enforcement-layer solutions like DLP, CASB, and ZTNA as the security program matures.

Fortra’s solutions are actively used by Australian Government entities and their service providers to meet PSPF obligations across the information and technology/ICT security domains. Fortra Data Classification already has a track record in Australian government environments, and Fortra’s broader defensive security portfolio is designed to address the controls that the PSPF and its companion frameworks require.