Frameworks · PSPF
Coming soonProtective Security Policy Framework readiness
PSPF readiness is coming soon to TrustProof: it will take you through the six security domains of Release 2026 (governance, risk, information, technology, personnel and physical), whether you are a Commonwealth entity or a supplier meeting PSPF requirements under contract. There is no PSPF certification: entities self-assess their maturity each year, and TrustProof will keep the evidence and sign-offs behind that assessment.
Key facts
What you can check
- Six domains
- Readiness items across governance, risk, information, technology, personnel and physical security, in TrustProof's own words.
- Entity or supplier
- It will be asked when the programme starts. A supplier can set aside items only a Commonwealth entity can meet, such as the annual PSPF report, with a written justification.
- Release 2026 changes
- Includes the newer expectations, such as a stocktake of internet-facing technology, planning for post-quantum cryptography, controls on generative AI and a policy against publicly disclosing security clearances.
- Unclassified evidence only
- TrustProof is not a system for security-classified information. Keep evidence you upload at OFFICIAL and unclassified.
- Read-only AWS role
- TrustProof connects through a read-only IAM role you create from our CloudFormation template and can remove at any time. No passwords, no stored keys.
- Hosted in AWS Sydney
- TrustProof runs on AWS in the Sydney region (ap-southeast-2), encrypted at rest and in transit.
What TrustProof does
- Will walk you through each domain with plain-language questions and a maturity rating
- Will record whether you are a Commonwealth entity or a supplier, and which items you may set aside
- Will track your security plan, policies and technology asset stocktake with review dates
- Will collect AWS evidence for the technology domain through a read-only role
- Will give your adviser or internal auditor their own dashboard, with two-step verification
What TrustProof doesn't do
- TrustProof does not certify, and there is no PSPF certification.
- It does not lodge your annual PSPF report and is not legal advice.
- TrustProof is not affiliated with or endorsed by the Department of Home Affairs.
FAQ
Frequently asked questions
Is there a PSPF certification?
No. Commonwealth entities assess their own maturity each financial year and report it to the Department of Home Affairs. Suppliers meet the requirements in their contract, and the contracting entity decides what evidence it needs.
We are a supplier, not a Commonwealth entity. Is this for us?
Yes. You will choose "supplier" when you start, set aside the items only an entity can meet with a justification, and record which contract clauses bring PSPF requirements to you.
Can we upload classified documents?
No. TrustProof is not a system for security-classified information. Keep evidence at OFFICIAL and unclassified, and refer to classified material by its reference rather than uploading it.
When will PSPF readiness be available?
It is coming soon. The free read-only AWS scan and One-Button Fix are available today. Talk to us if you would like to hear when it opens; this page will be updated when it does.
What does it cost?
The first AWS scan is free. One-Button Fix is A$1,499 one-off. Plans are a one-off Readiness Programme plus Continuous Monitoring from A$899 a month. All prices are in Australian dollars and include GST.