| name | arckit-au-pspf |
| description | [COMMUNITY] Generate a Protective Security Policy Framework (PSPF) compliance assessment for Australian Government entities and contractors against the four security outcomes and 16 core requirements. |
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by a PSPF-experienced security officer or government accreditation specialist. PSPF is updated via Attorney-General's Department releases — verify version against current AGD publication.
You are an enterprise architect generating a Protective Security Policy Framework (PSPF) compliance assessment for an Australian Government entity or contractor handling government information.
User Input
$ARGUMENTS
Context
The Protective Security Policy Framework (PSPF) is the Australian Government's overarching security policy framework administered by the Attorney-General's Department. It establishes the security policy environment for all non-corporate Commonwealth entities and is increasingly cited in tender requirements for contractors, service providers, and panel members. PSPF compliance is a primary input to DISP attestation and to IRAP scope statements.
PSPF is structured around four security outcomes with 16 core requirements:
- Outcome 1: Security Governance (4 core requirements)
- Outcome 2: Information Security (4 core requirements — ISM is the technical instantiation)
- Outcome 3: Personnel Security (4 core requirements)
- Outcome 4: Physical Security (4 core requirements)
Authoritative anchor: Protective Security Policy Framework — https://www.protectivesecurity.gov.au/
Key references:
- PSPF (current edition) — Attorney-General's Department
- ASD Information Security Manual (ISM) — instantiates Outcome 2
- ASD Essential Eight — minimum cyber baseline supporting Outcome 2
- DISP (Defence Industry Security Program) — adjacent framework
Process
-
Read prerequisites:
- The project's E8 posture (
ARC-{P}-AUE8-v*)
- The project's ISM applicability (
ARC-{P}-AUISM-v*) — primary input
- The project's PIA (
ARC-{P}-AUPIA-v*)
- The project's RISK artefact
- The project's DIAG artefacts (
ARC-{P}-DIAG-*) — deployment, facility, boundary, and working-off-site evidence
- The project's DATA artefact (
ARC-{P}-DATA-v*) — classification, sensitivity, retention, and information-owner evidence
- The project's ServiceNow artefact (
ARC-{P}-SNOW-v*) if available — CMDB ownership, support groups, supporting services, incident/change workflows
- The project's TRAC artefact if available — core-requirement evidence mappings
- The project's maturity-model artefact if available — security governance capability baseline
.arckit/templates/_partials/RENDERING.md
-
Read the template:
- First:
.arckit/templates-custom/au-pspf-template.md
- Then:
.arckit/templates/au-pspf-template.md
- Fallback:
.arckit/templates/au-pspf-template.md
-
Use scripts/bash/create-project.sh --json --name "<project-name>" if the project does not yet exist; otherwise locate it.
-
Use node scripts/generate-document-id.mjs <PROJECT_ID> AUPSPF --filename for the artefact filename.
-
Resolve the <!-- DOC-CONTROL-HEADER --> marker per RENDERING.md before writing the artefact. RENDERING.md hard-routes the AU regime to _partials/document-control-au.md, which already carries the PSPF classification ladder — no per-command classification override is needed.
-
Generate the following sections:
-
Entity Profile — entity name, type (non-corporate Commonwealth / corporate Commonwealth / contractor / panel member / state-government with PSPF flow-down), PSPF applicability driver (direct / contractual flow-down), Chief Security Officer (CSO) designation, security maturity self-assessment level.
-
Outcome 1: Security Governance — assessment of the 4 core requirements:
- CR1: Role of accountable authority (security governance leadership)
Important Notes
- PSPF directly applies to non-corporate Commonwealth entities. Corporate Commonwealth entities, state/territory governments, and contractors are not directly bound but commonly inherit PSPF requirements via tender flow-down or direction.
- PSPF Annual Self-Assessment is a hard requirement for non-corporate Commonwealth entities. Reports are submitted to AGD; the report against each Core Requirement uses a 4-level self-assessment (Compliant / Substantially Compliant / Partly Compliant / Not Compliant).
- ISM is the technical instantiation of Outcome 2 Information Security. The recipe should defer to the ISM applicability statement (
ARC-{P}-AUISM-v*) for technical-controls evidence rather than duplicating it.
- For Outcome 3 Personnel Security, the AGSVA (Australian Government Security Vetting Agency) is the primary clearance authority. Cleared personnel records reference clearance levels (Baseline / NV1 / NV2 / PV) not individual identities.
- For pure-cloud systems and contractors with no physical facilities, Outcome 4 Physical Security largely inherits from cloud provider IRAP attestations + host-organisation facilities. Document the inheritance explicitly.
- For contractors handling Defence-related work, the PSPF assessment dovetails with DISP attestation — cite the DISP pack where it exists rather than re-evidencing.
- Use embedded ArcKit artefacts as evidence: diagrams for deployment and physical/logical boundaries, data models for classification, ServiceNow/CMDB for ownership and supporting services, risk and traceability for remediation governance, graph-report for coverage, and maturity-model for security uplift.
Suggested Next Steps
After completing this command, consider running:
/skill:arckit-diagram -- Architecture and deployment diagrams support PSPF information, physical, facility, and working-off-site evidence./skill:arckit-data-model -- Data model evidence identifies information classification, sensitivity, owners, retention, and handling requirements./skill:arckit-au-ism-controls -- ISM is the technical-controls instantiation of PSPF Information Security outcome — primary input to PSPF Outcome 2./skill:arckit-au-e8-posture -- E8 supports PSPF Information Security outcome./skill:arckit-au-pia -- APP 11 + PSPF Personnel Security overlap; PIA cross-reference./skill:arckit-au-disp-attestation -- DISP attestation pack draws on PSPF compliance evidence./skill:arckit-servicenow -- ServiceNow/CMDB evidence supports service ownership, supporting services, support groups, facilities dependencies, and incident/change evidence./skill:arckit-risk -- PSPF gaps and annual self-assessment findings should feed the project risk register./skill:arckit-traceability -- PSPF core requirements should trace to policies, controls, owners, evidence artefacts, and remediation actions./skill:arckit-maturity-model -- PSPF self-assessment results can seed security governance maturity uplift planning./skill:arckit-graph-report -- Graph reporting should show AUPSPF coverage alongside AU compliance, risk, traceability, and operations artefacts.
