Defence Security Principles Framework (DSPF)

Australia

v2024

6 domains

21 controls

The Defence Security Principles Framework sets out security principles and controls for the Australian Department of Defence and its industry partners. It is a principles-based framework supporting a progressive protective security culture. All Defence personnel, contractors, consultants and outsourced service providers must adhere to the DSPF.

Verified

Defence Security Principles Framework (DSPF) is a compliance framework from Australia with 6 domains and 21 controls that map to 2 other frameworks. The largest domains are DSPF: Information and Technology (Cyber) Security (7 controls), DSPF: Personnel Security (6 controls), DSPF: Information Security (4 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

DSPF: Defence Industry and Research Security

2 controls

Controls in the DSPF: Defence Industry and Research Security domain of Defence Security Principles Framework (DSPF): 2 controls
Code	Title	Description
DSPF-P16	Defence Industry Security Program	Defence industry entities handling Defence classified information must meet the requirements of the Defence Industry Sec...
DSPF-P31	Defence research, innovation and collaboration security	Defence research, innovation and collaboration activities must apply security controls appropriate to the sensitivity of...

DSPF: Information Security

4 controls

Controls in the DSPF: Information Security domain of Defence Security Principles Framework (DSPF): 4 controls
Code	Title	Description
DSPF-P10	Classification and protection of official information	Official information must be assessed for sensitivity/classification and protected with controls commensurate with its c...
DSPF-P13	Communications security (COMSEC)	Communications carrying official/classified information must be protected through approved cryptographic and COMSEC meas...
DSPF-P14	Audio-visual security	Audio-visual and conferencing environments handling classified discussions must be protected against technical and acous...
DSPF-P15	Foreign release of official information	The release of official information to foreign governments and entities must follow the foreign release and disclosure c...

DSPF: Information and Technology (Cyber) Security

7 controls

Controls in the DSPF: Information and Technology (Cyber) Security domain of Defence Security Principles Framework (DSPF): 7 controls
Code	Title	Description
DSPF-P20	Information and technology security - logging and monitoring	ICT systems must implement event logging and log management sufficient to detect and investigate security events.
DSPF-P21-22	Information and technology security - physical and personnel	ICT systems must be protected through physical security of equipment/facilities and through personnel security of those...
DSPF-P23	Cyber security assessment and authorisation	ICT systems must undergo security assessment and be formally authorised (accredited) to operate at the appropriate class...
DSPF-P24	Information and technology security - incident management	Cyber and ICT security incidents must be detected, responded to and reported in accordance with the framework.
DSPF-P25	Information and technology security - gateways and data transfer	Connections between systems/domains and transfers of data across security boundaries must be controlled through approved...
DSPF-P26	Information and technology security - portable devices and media	Portable devices and removable media used with official/classified information must be controlled, encrypted and managed...
DSPF-P27-29	Information and technology security - system planning, management and business impact	ICT systems must be planned, managed and operated with consideration of business impact levels, including secure configu...

DSPF: Personnel Security

6 controls

Controls in the DSPF: Personnel Security domain of Defence Security Principles Framework (DSPF): 6 controls
Code	Title	Description
DSPF-P40	Personnel security clearance	Personnel requiring access to classified information or assets must hold and maintain an appropriate security clearance.
DSPF-P41	Temporary access to classified information and assets	Where temporary access to classified information or assets is required pending clearance, it must be managed under defin...
DSPF-P42	Identity security	The identity of personnel must be established and verified to an appropriate level of assurance before granting access.
DSPF-P44	Overseas travel	Personnel with access to classified information must follow overseas travel security requirements, including pre-travel...
DSPF-P45	Contact reporting	Personnel must report contacts, approaches or relationships that may present a security concern (including foreign conta...
DSPF-P46	Counterintelligence	Defence and partners must apply counterintelligence measures to detect and mitigate espionage, foreign interference and...

DSPF: Physical Security

1 controls

Controls in the DSPF: Physical Security domain of Defence Security Principles Framework (DSPF): 1 controls
Code	Title	Description
DSPF-PHYS-PRIN	Physical security of facilities, zones and assets	Facilities, security zones and physical assets holding classified information must be protected through certified physic...

DSPF: Security Governance and Risk

1 controls

Controls in the DSPF: Security Governance and Risk domain of Defence Security Principles Framework (DSPF): 1 controls
Code	Title	Description
DSPF-GOV-PRIN	Security governance, risk management and culture	Defence and its partners must establish security governance (accountable authority, roles and responsibilities), manage...

Maps to 2 other frameworks

21 total controls

Defence Industry Security Program (DISP)

3 source controls mapped|3 target controls covered

14%

NIST Cybersecurity Framework 2.0

1 source controls mapped|1 target controls covered

Compare Defence Security Principles Framework (DSPF) with Defence Industry Security Program (DISP)

Coverage is not the same as your position

This page shows what Defence Security Principles Framework (DSPF) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is Defence Security Principles Framework (DSPF) and who does it apply to?

Defence Security Principles Framework (DSPF) is a compliance framework from Australia with 6 domains and 21 controls. The Defence Security Principles Framework sets out security principles and controls for the Australian Department of Defence and its industry partners. It is a principles-based framework supporting a progressive protective security culture. All Defence personnel, contractors, consultants and outsourced service providers must adhere to the DSPF. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Defence Security Principles Framework (DSPF) actually require?

Defence Security Principles Framework (DSPF) has 21 controls organised across 6 domains. The largest domains are DSPF: Information and Technology (Cyber) Security (7 controls), DSPF: Personnel Security (6 controls), DSPF: Information Security (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Defence Security Principles Framework (DSPF) do I already cover?

Defence Security Principles Framework (DSPF) maps to 2 other compliance frameworks. The top mapping partners are Defence Industry Security Program (DISP) (14% coverage), NIST Cybersecurity Framework 2.0 (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement Defence Security Principles Framework (DSPF)?

Start your Defence Security Principles Framework (DSPF) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Defence Security Principles Framework (DSPF) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 21 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.

Get Started Free →

Free forever, no credit card required