Fortra for Protective Security Policy Framework (PSPF) Compliance

Provide security awareness training to all personnel, including contractors, at engagement and annually thereafter.

Role-based phishing simulation and security awareness training.

Post-training, personnel are knowledgeable about various cyber risks that can lead to data leaks, fraud, and (more importantly) business, financial, and reputational damage.

Provide targeted security training to personnel in specialist or high-risk positions.

Targeted training campaigns, assignable by role, department, or risk profile.

As opposed to a ‘one size fits all’ approach to training, the highest-risk personnel are identified, ensuring that the users who handle PSPF-regulated data are taught the gravity of compliance errors and cyber threats.

Report significant or externally reportable security incidents to the relevant authority within the applicable timeframe.

Real-time alerting and incident logging with user, file, and timestamp context.

Real-time alerting and incident logging ensure immediate action in the wake of an incident, limiting or even avoiding accidental/malicious data loss in the process. 

Section 5.1

Determine and document the entity's tolerance for security risks.

Continuous risk visibility across cloud environments, including misconfigurations and access anomalies.

Continuous monitoring also means continuous posture evaluation, meaning it takes less time to identify flux in overall risk tolerance and apply more precise remediation.

Manage security risks arising from procurement and outsourced services.

Identification of sensitive data accessible by third-party integrations and cloud services.

A generated audit trail with complete visibility over all data assets and access privileges, along with prevention mechanisms to proactively prevent inadvertent or wrongful data sharing.

Use secure and verifiable third-party vendors; manage and approve residual risks with the CISO.

Monitoring of third-party cloud application usage and flagging of unauthorized or unverified applications.

Ensures only company-vetted and approved applications are used; i.e., constant enforcement of sensitive data flow.

Implement an insider threat program for entities managing security clearance subjects.

A real-time audit of data transactions and movements, with stopgaps and actions to restrict leaks of sensitive information.

Section 9.1

Assess the sensitivity of official information based on the potential damage if its confidentiality was compromised.

Impact-based classification guidance at the point of content creation.

Downstream data management systems will act upon both content- and context-driven classification, ensuring comprehensive protection against inadvertent data leaks.

Set security classifications at the lowest reasonable level.

Policy tips and suggested classification prompts to prevent over-classification.

Any artifact, newly created or pre-existing, will have a minimum level of classification to prevent data leakage.

Clearly mark security classified information with the applicable classification using text-based markings.

Automatic application of visible text-based markings to headers, footers, and email subject lines.

Applied markings are clear, concise, and automated, preventing human error and any resulting data leakage.

Section 13.1

Apply ISM cyber security principles across all stages of each technology system's lifecycle, on a risk-based approach.

Continuous vulnerability discovery, prioritization, and remediation tracking.

Based on discovered vulnerabilities and misconfigurations, an organization’s system is given a risk score with prioritized, actionable remediation tactics—ensuring timely, risk-based threat mitigation.

Develop and maintain a cyber security strategy in accordance with the ISM and Guiding Principles to Embed a Zero Trust Culture.

Identity-verified, least-privilege access enforcement.

Access to data assets is only granted on a verifiable, need-to-know basis as opposed to trusting a user or device by default.

Use a Protective DNS service or equivalent mechanism to prevent connections to known malicious endpoints.

Web traffic inspection and filtering of connections to known malicious domains.

Enforcement of security policies is extended to the web, meaning users will be blocked from connecting to malicious domains and prompted to reinforce security awareness.

Section 17.2

Provide access to classified information only to personnel with a need-to-know.

Classification label-based access controls.

Robust, granular classification of all artifacts at rest or in motion ensure downstream systems grant access based on strict classification-based policy conditions.

Actively assess, monitor, and manage the ongoing suitability of personnel.

Behavioral risk metrics from phishing simulations and training engagement.

Risk metrics based on engagement with trainings and social engineering simulations quantify user competency, meaning those with the highest risk profiles can be identified and trained accordingly.