PSPF Security Risk Assessment

Q: What is the Protective Security Policy Framework (PSPF)?

The Protective Security Policy Framework is the Australian Government's framework for protecting people, information and assets, administered by the Attorney-General's Department. It sets out policies and Core Requirements across governance, information security, personnel security and physical security that non-corporate Commonwealth entities must apply and report against, and that many state agencies and government contractors adopt as best practice.

Q: What is the difference between a PSPF assessment and a general security risk assessment?

A general security risk assessment identifies and rates threats, vulnerabilities and consequences specific to an organisation's environment. A PSPF assessment does the same work but is structured against the PSPF's specific Core Requirements and four outcomes, producing a maturity rating and findings that map directly to the framework a Commonwealth entity or government-aligned organisation is required to report against.

Q: Is my organisation required to comply with the PSPF?

Non-corporate Commonwealth entities are formally required to apply the PSPF. Corporate Commonwealth entities, state and local government agencies, critical infrastructure operators and organisations contracting to government are not always formally bound by it, but frequently need to demonstrate PSPF-aligned practices to satisfy tender conditions, tenancy requirements or obligations under the Security of Critical Infrastructure Act 2018.

Q: How long does a PSPF assessment take?

Timeframes depend on the size of the organisation, the number of sites in scope and how many of the four PSPF outcomes are being assessed. A single-site assessment covering all four outcomes typically takes several weeks from initial scoping to final report.

Q: Does Barrick Group deliver security services as well as PSPF assessments?

No. Barrick Group is an independent risk management and advisory firm. We do not sell or deliver security services, and we have no financial stake in what solutions or suppliers you choose as a result of a PSPF assessment.

What is a Protective Security Risk Assessment?

A Protective Security Risk Assessment (PSRA) is a formal risk assessment conducted in accordance with the Protective Security Policy Framework (PSPF), the Australian Government's framework for protecting people, information and assets. PSRAs are typically required for Commonwealth entities, state government tenants, critical infrastructure operators, and organisations that handle sensitive or classified information.

Governance Outcome

Assessment of accountable authority arrangements, security governance structures and risk ownership, aligned with PSPF Core Requirement 1.

Information Security Outcome

Review of information classification, handling and access arrangements against PSPF Core Requirements 8, 9 and 10.

Personnel Security Outcome

Assessment of eligibility, suitability and ongoing assurance arrangements for personnel with access to sensitive resources, aligned with PSPF Core Requirements 4 to 7.

Physical Security Outcome

Assessment of facility and asset protection measures against PSPF Core Requirements 11 and 12, including zoning, access control and security construction standards.

Documented Risk Register

A complete risk register with risk ratings, treatment recommendations and a prioritised implementation plan your organisation can act on.

Independent Assessment

An assessment conducted independently of any product or service recommendation, so findings reflect your actual risk environment.

Who needs a PSPF assessment?

The PSPF applies directly to non-corporate Commonwealth entities and is frequently adopted, in whole or in part, by state government agencies, critical infrastructure operators and organisations contracting to government.

Commonwealth Entities

Non-corporate Commonwealth entities are required to apply the PSPF and report against it annually.

State and Local Government

Many state and local government agencies adopt PSPF principles as best practice, particularly where they hold Commonwealth information or assets.

Critical Infrastructure Operators

Organisations captured by the Security of Critical Infrastructure Act 2018 often align their risk management program with PSPF principles to satisfy positive security obligations.

Government Contractors and Tenants

Organisations occupying government tenancies or delivering contracted services to government are frequently required to demonstrate PSPF-aligned security arrangements.

Our approach to PSPF assessments

We follow the same eight-stage engagement methodology we apply across all risk assessment work, adapted to the four PSPF outcomes: Security Planning and Governance, Information Security, Personnel Security, and Physical Security.

Context and Scoping

We confirm which PSPF requirements apply to your organisation and agree the scope and boundaries of the assessment with you before work begins.

Evidence-Based Assessment

We assess current arrangements against each applicable Core Requirement, drawing on documentation review, site inspection and stakeholder consultation.

Defensible Reporting

Findings are documented in a form suitable for board, executive and regulator review, with a clear maturity rating against each PSPF outcome.

Practical Treatment Plans

Recommendations are prioritised and costed so your organisation can plan remediation realistically, rather than facing an unworkable list of findings.

FAQs

PSPF and Protective Security Risk Assessments: Common Questions

What is the Protective Security Policy Framework (PSPF)?

What is the difference between a PSPF assessment and a general security risk assessment?

Is my organisation required to comply with the PSPF?

How long does a PSPF assessment take?

Does Barrick Group deliver security services as well as PSPF assessments?

PSPF Risk Assessments

Protective Security Risk Assessments for government and critical infrastructure organisations, aligned with the Protective Security Policy Framework.

What is a Protective Security Risk Assessment?

Who needs a PSPF assessment?

Our approach to PSPF assessments

PSPF and Protective Security Risk Assessments: Common Questions

Need a PSPF-aligned risk assessment?