Who must comply with Protective Security Policy Framework (PSPF)?

Federal entities bound by PSPF — governance, information, personnel + physical security.

The Protective Security Policy Framework sets the Australian Government's minimum protective security standards across six security domains, covering how entities protect their people, information and resources at home and overseas. It is made binding by the Minister's Directive on the Security of Government Business, and the Department of Home Affairs reviews it annually; PSPF Release 2026 was issued on 1 July 2026. The framework mandates named roles (an Accountable Authority, a Chief Security Officer and a Chief Information Security Officer), security planning, incident management and security investigations, third-party risk management in procurement and contracts, classification and handling of information, Essential Eight cyber strategies, personnel vetting and clearances, and physical security zones. Since 1 November 2024 annual reporting has replaced the older maturity self-assessment model.

Applies only if you are a contracted provider handling Commonwealth information. Whether it applies turns on a fact that no industry, structure or size settles on its own.

How the regulator frames it: Non-corporate Commonwealth entities, which must apply the PSPF under s 21 of the Public Governance, Performance and Accountability Act 2013. It is better practice for corporate Commonwealth entities and wholly-owned Commonwealth companies. State and territory agencies holding Australian Government security classified information, and contractors and service providers whose deeds or agreements require it, must apply the relevant parts.

What triggers it: Being a non-corporate Commonwealth entity; for others, accessing Australian Government security classified information or signing a government contract or deed that imports PSPF requirements.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a trigger outside this questionnaire.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business supplies government customers: it becomes worth checking, because it applies only if you are a contracted provider handling Commonwealth information.

The engine shows this obligation as "check whether this applies" when a business has government customers. It then applies only if you are a contracted provider handling Commonwealth information. That fact is not something Rules Mate can infer from industry, structure or size.

When due

Ongoing, with a protective security report each financial year from the Accountable Authority to its minister and to the Department of Home Affairs, lodged through the PSPF reporting portal.

Frequency

Annual

Evidence to keep

Annual protective security report and portal submission; security plan and risk tolerance statement; Chief Security Officer and Chief Information Security Officer appointments; security incident register and investigation records; information asset register; contract clauses and third-party risk assessments; security clearance and pre-employment screening records; security zone certification and accreditation records.

In force from

1 July 2025

Status

Current

Priority

Critical

Maximum penalty: The PSPF is government policy, not a statute, so it carries no pecuniary penalty of its own. Accountable Authorities are accountable to their minister for the security of their entity, Home Affairs quality-assures annual reports, and a contractor's breach of PSPF terms is dealt with under its contract or deed.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• SoNS — Systems of National Significance (SOCI): Declared SoNS face enhanced cyber security obligations.

Rules Mate tracks 3 published obligations tagged "cyber security", 2 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated critical priority, and is a annual obligation.

Free tools that help with this obligation:

• Essential Eight maturity check
• Cyber incident notifications
• Ransomware payment reporting