PSPF Maturity Self-Assessment Model Personnel security Outcome: Each entity ensures its employees (and contractors) are suitable to access Australian Government resources and meet an appropriate standard of integrity and honesty. Table PSPF Maturity Self-Assessment Model – Personnel security Ad hoc Developing Managing Embedded Description Partial: Some PSPF core and supporting requirements are implemented although are not well understood across the entity. Security outcomes are not being achieved in some areas. Substantial: The majority of PSPF core and supporting requirements are implemented, broadly managed and understood across the entity. Entity is largely meeting security outcomes. Full: All PSPF core and supporting requirements are implemented, integrated into business practices and effectively disseminated across the entity. Entity meets security outcomes. Excelled: All PSPF core and supporting requirements are implemented, are effectively integrated and exceeding security outcomes with better-practice guidance achieving high performance. Eligibility and suitability The entity partially has procedures and systems in place to ensure personnel are eligible and suitable to access Australian Government resources. screening is ad hoc and security vetting requirements (where relevant) are partially followed. Some risks associated with eligibility and suitability of personnel are managed. The entity has developed the majority of the entity’s procedures and systems to ensure that personnel are eligible and suitable to access Australian Government resources. screening practices are substantially in place and security vetting requirements (where relevant) mostly followed. The entity manages the majority of risks associated with eligibility and suitability of personnel. Procedures and systems are in place to ensure that all personnel are eligible and suitable to access Australian Government resources. All pre-employment screening and security vetting (where relevant) requirements are followed. These procedures and systems mitigate risks identified in the entity’s personnel security risk assessment. The entity excels in implementing efficient and timely processes to ensure the eligibility and suitability of personnel to access Australian Government resources. All requirements are followed and the entity has comprehensive practices in place to proactively manage risks identified in its personnel security risk assessment.
Ongoing assessment of personnel The entity assesses and partially manages ongoing suitability of all personnel affecting. Information of security concern for ongoing suitability of personnel is assessed and shared on an ad hoc basis with relevant stakeholders. Some security clearance maintenance requirements (where relevant) are met. The entity has substantially developed its procedures and systems to assess and manage ongoing suitability of all personnel. In the majority of cases, information of security concern for ongoing suitability of personnel is assessed and shared by the entity with relevant stakeholders. Procedures are mostly in place to ensure compliance with security clearance maintenance requirements (where relevant). Procedures and systems are in place to ensure that the ongoing suitability of personnel is assessed and managed in accordance with the entity’s personnel security risk assessment. The entity has established lines of communication and processes to ensure information of security concern is shared with stakeholders as appropriate. The entity has procedures in place to ensure compliance with all security clearance maintenance requirements (where relevant). The entity is proactive in assessing and managing the suitability of personnel, including security clearance maintenance requirements (where relevant), to ensure integrity of the entity’s core business. The entity has well established lines of communication and robust processes to ensure information of security concern for ongoing suitability of personnel is shared with stakeholders in a timely manner. Separating personnel Partial ad hoc processes are in place to ensure that separating personnel have their access to Australian Government resources withdrawn and are informed of their ongoing security obligations. Separating personnel, in the majority of cases, understand their ongoing security obligations and have their access to Australian Government resources withdrawn. Systems and processes are substantially developed to verify consistency of separating personnel practices across the entity. The entity has in place systems and processes to ensure that all separating personnel understand their ongoing security obligations, particularly where they have had access to sensitive and security classified information and resources during their employment. Separating personnel have their access to Australian Government resources withdrawn within an appropriate timeframe. The entity has proactively implemented systems and processes that are reviewed regularly for separating personnel. Access to Australian Government resources is withdrawn from personnel on separation. The entity ensures separating personnel are debriefed and provided a comprehensive understanding of their ongoing security obligations. Information of security concern about separating personnel is shared with relevant stakeholders, including internally, where appropriate. Risk assessments are undertaken, where appropriate.