Explainer
PSPF security training requirements explained.
Annual awareness training, targeted training and the July 2026 changes.
A plain-language guide for Chief Security Officers, security advisers and learning teams in Commonwealth entities: the training requirements in the Protective Security Policy Framework, what changed in Release 2026, who must be trained, and how to show it in your annual report.
Key points.
The short version, for a buyer who has five minutes. The sections below give the detail.
- The Protective Security Policy Framework (PSPF) is the Australian Government’s policy for protective security. It applies to non-corporate Commonwealth entities and sets mandatory requirements across six domains: governance, risk, information, technology, personnel and physical security.
- Security awareness training must be provided to personnel, including contractors, at engagement and annually thereafter (Requirement 0024).
- Targeted security training must be provided to personnel, including contractors, in specialist or high-risk positions (Requirement 0025).
- From 1 July 2026, security awareness training must cover foreign interference, espionage, cultivation and exploitation by foreign powers (Requirement 0219).
- Training sits inside a broader duty: the Accountable Authority and Chief Security Officer must maintain a program to foster a positive security culture (Requirement 0023).
- Entities that manage security clearance subjects at Baseline to Positive Vetting must implement an insider threat program, which includes security culture and awareness training (Requirement 0051).
- The Accountable Authority provides an annual protective security report to the entity’s Minister by December each year, and reports to the Department of Home Affairs (Requirement 0031). Training records are part of the evidence behind it.
Source: Protective Security Policy Framework, Release 2026, Department of Home Affairs (protectivesecurity.gov.au). Requirement numbers are as published. This is general information, not legal or security advice; check the current release and your entity’s own policies.
What is the PSPF?
The Protective Security Policy Framework sets out Australian Government policy for protecting people, information and assets. It is administered by the Department of Home Affairs. Non-corporate Commonwealth entities must comply; it represents better practice for corporate Commonwealth entities, and state and territory agencies and third-party providers that hold Australian Government classified information apply the relevant parts under their agreements.
The framework works at three levels: principles, mandatory requirements, and standards and technical manuals that add detail on specific topics. Requirements are numbered, and each carries the domain it belongs to and the date it took effect. Release 2026 is the current version.
- GovernanceAccountable Authority, Chief Security Officer, security planning, culture, training and reporting.
- RiskManaging security risks, including insider threat and foreign interference.
- InformationClassifying, handling and protecting official information.
- TechnologySecuring systems, including the Essential Eight.
- PersonnelSuitability, clearances and ongoing assessment of people with access.
- PhysicalProtecting people, information and assets in facilities.
The training requirements, one by one.
The five PSPF requirements that bear directly on security training, with the requirement number for your records.
- Requirement 0024: awareness training at engagement and annuallySecurity awareness training is provided to personnel, including contractors, at engagement and annually thereafter. “Personnel” is wide: employees, contractors and anyone else the entity engages. Two moments matter for your records: the date each person started, and the date of their most recent annual training.
- Requirement 0025: targeted training for specialist and high-risk positionsTargeted security training is provided to personnel, including contractors, in specialist or high-risk positions. The PSPF leaves the entity to define those positions. Common examples are security officers and advisers, people who handle classified material, clearance sponsors and managers, facilities and ICT security staff, and roles exposed to foreign contact.
- Requirement 0219: foreign interference and espionage, from 1 July 2026Security awareness training covers foreign interference, espionage, cultivation and exploitation by foreign powers. The PSPF says this training is most effective when it covers what foreign interference and espionage are, how to recognise them, how to recognise cultivation and exploitation by a foreign actor, and the risks of disclosing security clearance details on online platforms.
- Requirement 0023: a positive security cultureThe Accountable Authority and Chief Security Officer develop, implement and maintain a program to foster a positive security culture. The PSPF describes awareness training as a vital element of that program, championed and practised by senior leadership, with ongoing reminders rather than a single annual event.
- Requirement 0051: an insider threat programEntities that manage Baseline to Positive Vetting security clearance subjects implement an insider threat program. The PSPF describes an effective program as covering security governance and planning, personnel security, security culture and awareness training, access controls, physical and ICT controls and audit, and review, reporting and response processes.
What the PSPF says good training looks like.
Release 2026 does not prescribe a course. It describes what makes security awareness training effective. In the framework’s own terms, training works best when it:
- is championed and practised by senior leadership
- delivers an ongoing program that regularly reminds people of their responsibilities, not a once-a-year module
- briefs clearance holders on the access privileges and prohibitions of their clearance level before access is given, and at renewal
- gives people with specific security duties appropriate and up-to-date training
- communicates the entity’s own protective security practices and procedures to all personnel, including contractors
- gives everyone a clear understanding of the security environment the entity operates in and the threats relevant to their roles
The thread through all six is relevance: training built around the entity’s own environment, roles and threats, rather than generic content.
What changed in Release 2026.
The changes in the 2026 release that affect security training, and what carries over from 2024.
- New training contentForeign interference, espionage, cultivation and exploitation by foreign powers must be covered in security awareness training from 1 July 2026 (Requirement 0219).
- Clearance information onlineThe PSPF expects entities to have a policy that personnel do not publicise security clearance information on online platforms, including social media, recruitment and professional networking sites. Training should explain why.
- Numbered requirementsEvery requirement carries a number, domain and effective date, which makes it easier to map training and records to the framework.
- Same core dutiesAnnual awareness training, targeted training for high-risk roles, a security culture program and insider threat programs carry over from the 31 October 2024 release.
Source: Protective Security Policy Framework, Release 2026, Department of Home Affairs (protectivesecurity.gov.au). Requirement numbers are as published. This is general information, not legal or security advice; check the current release and your entity’s own policies.
Showing it in your annual report.
The Accountable Authority provides an annual protective security report to the Minister by December, and entities report to the Department of Home Affairs through the PSPF Reporting Portal. Training is one of the things the report must stand behind. The records that make that straightforward are:
- A register of who must be trainedAll personnel, including contractors, with start dates, so “at engagement” can be shown.
- Completion and assessment recordsDate, content version and, where capability must be demonstrated, the assessment result rather than attendance alone.
- Defined specialist and high-risk positionsThe list of roles that require targeted training, and the training each has received.
- Content mapped to requirementsWhich module covers Requirement 0024, 0025 and 0219 content, so an auditor can trace it.
- Evidence of the culture programLeadership messages, campaigns and reminders through the year, not only the annual module.
- EvaluationWhat changed after training: reporting rates, exercise results or survey measures, so the report can speak to effect as well as activity.
Common gaps we see.
The gaps that appear most often when entities map their training against the requirements.
- Contractors and labour hire left out of the annual cycle
- Specialist and high-risk positions never formally defined, so targeted training cannot be evidenced
- Generic e-learning that does not mention the entity’s own policies, systems or reporting pathways
- Foreign interference content still not added, although Requirement 0219 took effect on 1 July 2026
- Attendance records only, with nothing to show people can apply what they learned
- Security culture treated as the annual module, with no leadership program around it
Questions about PSPF training requirements.
Short answers to the questions security advisers and learning teams ask about PSPF training. If yours is not here, ask us.
Does the PSPF require annual security awareness training?
Yes. Requirement 0024 in PSPF Release 2026 requires security awareness training for personnel, including contractors, at engagement and annually thereafter.
Who needs targeted security training under the PSPF?
Requirement 0025 requires targeted security training for personnel, including contractors, in specialist or high-risk positions. The entity defines those positions; typical examples are security officers and advisers, people handling classified material, clearance sponsors and ICT and facilities security roles.
What must PSPF security training cover from 1 July 2026?
Requirement 0219 requires security awareness training to cover foreign interference, espionage, cultivation and exploitation by foreign powers, including the risks of disclosing clearance details on online platforms.
Does the PSPF apply to contractors?
Yes. The training requirements refer to personnel, including contractors. Contractors and labour hire should be in the same training and record-keeping cycle as employees.
Is online security awareness training enough to meet the PSPF?
The PSPF does not prescribe a format. It describes effective training as ongoing, led by senior leadership, specific to the entity’s environment and threats, and covering people’s actual security duties. A generic module on its own rarely meets that description, and no training alone makes an entity compliant.
Does the PSPF require an insider threat program?
Requirement 0051 requires entities that manage Baseline to Positive Vetting security clearance subjects to implement an insider threat program. Security culture and awareness training is one element of an effective program.
Where can I read the PSPF?
The framework, standards and guidelines are published by the Department of Home Affairs at protectivesecurity.gov.au. Release 2026 is the current version.
Build PSPF-aligned security capability.
Wisdom Learning designs security awareness and targeted security training around your entity’s own threats, policies and reporting arrangements, delivered by security-cleared trainers, with records to support your annual report. We respond within one business day.