Security and compliance frameworks are the standards, policies and legislation that set out how an organisation should protect its people, information, assets and operations. In Australia, they range from government policy, such as the Protective Security Policy Framework, to legislation, such as the Security of Critical Infrastructure Act, and from international standards, such as the ISO management-system series, to sector rules in areas like financial services and defence. This page maps the main frameworks, explains how they relate, and points to deeper guidance on each.
Most organisations do not deal with a single framework. A hospital, an airport operator, a bank or a government supplier will each sit under several at once, and the requirements overlap. Understanding how the frameworks fit together is the first step to meeting them efficiently rather than treating each as a separate project. Agilient works across these frameworks, and a security risk assessment is usually the practical starting point that ties them together.
Overview
What are security and compliance frameworks?
A security and compliance framework is a structured set of requirements or good-practice guidance for managing security risk. Some are mandatory and set by law or government policy. Others are voluntary standards that organisations adopt to demonstrate good practice, satisfy a customer or regulator, or provide a consistent way to manage risk.
The frameworks fall into a few broad types. Government policy frameworks, such as the PSPF, apply to public-sector entities and the suppliers that work with them. Legislation, such as the Security of Critical Infrastructure Act, imposes legal obligations on the operators of important assets. International management system standards, such as the ISO series for risk and business continuity, provide organisations with a recognised framework for certification. Sector rules, such as the prudential standards in financial services, apply within a particular industry.
Read together rather than in isolation, these frameworks describe a single objective: to protect the organisation against the threats it faces and to demonstrate that the protection is deliberate and maintained.
The landscape
The eight framework clusters
Agilient groups the Australian security and compliance landscape into eight clusters. Each is summarised below, with a link to more in-depth guidance where available.
Protective security (PSPF)
Government’s protective security policy across six domains is mandatory for Commonwealth entities.
Security risk management
AS ISO 31000:2018 and risk assessment are the foundation that others build on.
Physical and facility security
Access control, perimeter protection, CCTV and security design.
Cyber security
The Information Security Manual, the Essential Eight and the ISO/IEC 27000 series.
Critical infrastructure and the SOCI Act
Risk-management obligations for operators of defined critical assets.
Supply chain security
Third-party and contractor risk, with requirements flowing down to suppliers.
Financial services and APRA
CPS 230 and CPS 234 prudential and operational-resilience requirements.
Defence and the DISP
Security requirements for businesses working with Defence, Entry Level to Level 3.
How they connect
How do the frameworks relate to one another?
The frameworks are not separate silos. They share a common spine of risk management, and they overlap at the edges.
Risk management is the connective tissue. AS ISO 31000:2018 sits underneath the PSPF, the SOCI Act risk-management program, APRA’s requirements and the rest, because each ultimately asks an organisation to identify its risks and treat them. An organisation that runs one credible risk process can feed several frameworks from it rather than repeating the work.
The frameworks also cascade. Government policy, such as the PSPF, flows down to suppliers through contracts, so a private business can find itself meeting PSPF requirements without being a government entity. The SOCI Act addresses physical, personnel, supply chain, and cyber hazards at once. Financial services and defence add sector rules on top of the general frameworks rather than replacing them.
The practical implication is that meeting these frameworks is best approached as one coordinated program, not a series of disconnected audits. That is the principle Agilient applies, and it is why the security risk assessment is usually the first step.
Alongside these frameworks sits a related body of work: resilience, business continuity, crisis and emergency management. Agilient covers these disciplines as well, and they will be drawn together in a companion resilience and business continuity hub.
How we help
How Agilient supports security and compliance frameworks
Agilient is an independent, vendor-neutral security and risk consultancy that works across the frameworks described on this page. The firm helps organisations work out which frameworks apply to them, assess where they stand, and build a single program that meets the requirements that matter, rather than duplicating effort across overlapping standards. Work spans government, healthcare, aviation, defence, and critical infrastructure sectors across Sydney, Melbourne, Brisbane, Adelaide, and Canberra.
Work out which frameworks apply to you
Agilient can map your obligations across these clusters and build one coordinated program rather than a series of disconnected audits.
FAQs
Frequently asked questions
What are security and compliance frameworks?
Which security frameworks apply to Australian organisations?
How do the different frameworks relate to one another?
Is the PSPF mandatory for private companies?
Where should an organisation start?
References
- Department of Home Affairs, Protective Security Policy Framework, protectivesecurity.gov.au
- Federal Register of Legislation, Security of Critical Infrastructure Act 2018, legislation.gov.au
- Standards Australia, AS ISO 31000:2018 Risk management — Guidelines, standards.org.au
- Australian Prudential Regulation Authority, CPS 230 Operational Risk Management and CPS 234 Information Security, apra.gov.au
- Department of Defence, Defence Industry Security Program, defence.gov.au