For Projects · Sector

Government & Defence
Security

Government and defence facilities operate under the Protective Security Policy Framework and SCEC requirements. Security advisory needs to navigate these frameworks, produce audit-ready documentation, and deliver outcomes that satisfy both the regulator and the project team.

The challenge

Where security meets government requirements

Government and defence security operates within prescriptive frameworks where the margin for interpretation is narrow and the consequences of non-compliance are significant.

01 The PSPF establishes mandatory requirements for Australian Government entities across governance, information, personnel, and physical security. Security advisory needs to produce outputs structured to these requirements, not generic risk reports that require translation.
02 SCEC security zone requirements prescribe specific construction standards, access control, and emanation security for facilities handling classified information. The advisory must translate these specifications into design documentation architects and builders can implement without ambiguity.
03 Clearance and compartmentalisation constraints affect how security advisory is conducted: project teams at different clearance levels, compartmented information, and design details that cannot be shared across the full team. Advisory must operate within these constraints while delivering coherent design outcomes.
04 Overly restrictive security creates friction that degrades both productivity and compliance. Personnel find workarounds that introduce greater risk than the original threat. Proportionate design accounts for how people actually use facilities, not just how they should in theory.
05 Procurement documentation must enable capability acquisition, not just describe requirements. Specifications need to support accurate pricing by tenderers, objective evaluation by assessors, and verification of delivered outcomes against documented criteria.

Our role

How we work on government and defence projects

PSPF-aligned threat and risk assessment

Threat assessment structured to address the physical security requirements of the PSPF, with risk positions that map directly to the framework's mandatory and discretionary requirements. Outputs formatted for assurance review, with each risk finding linked to a specific PSPF requirement, with treatment options assessed for proportionality and documented for audit.

Security risk & threat analysis

SCEC security zone design

Security zone design compliant with ASIO Technical Notes, delivered by a SCEC Endorsed security consultant. Construction specifications for zone boundaries, access control configurations, emanation security measures, and inspection requirements, all translated into design documentation that the construction team can implement.

Security design management

Security systems design

CCTV, electronic access control, duress, and intruder detection systems designed to meet both PSPF requirements and operational needs. Specifications that address camera placement, field of view, lighting conditions, integration with access control, and alarm monitoring. Written so that systems integrators can deliver without interpretation and the outcome can be verified against documented performance criteria.

Security design management

Requirements assurance and safety cases

Security requirements traced from threat assessment through to design verification, with documented evidence at each stage. For projects requiring safety cases, security inputs structured to integrate with the broader safety assurance framework, demonstrating how security risks are managed alongside safety risks within a unified governance structure.

Systems & assurance

Track record

Selected experience

Defence and government engagements are delivered under confidentiality obligations, typically through engineering primes. Details below are generalised accordingly.

01 Security zone upgrades at a naval base, WA — electronic security design delivered through the project engineering team
02 Infrastructure and services security upgrades at a RAAF airbase, northern WA — multiple work packages via engineering primes
03 Training facility security design at a defence maritime precinct, WA
04 Electronic security design for regional government buildings, East Kimberley WA — with the project architect
05 Protective security framework review and standing threat intelligence for a state electoral commission

Client references for cleared engagements are available on request.

SCEC Endorsed security zone consulting

Questions

Frequently asked questions

What is the PSPF and who needs to comply?

The PSPF is the Australian Government's protective security policy, establishing mandatory requirements across security governance, information security, personnel security, and physical security. All non-corporate Commonwealth entities must comply; corporate entities are encouraged to adopt it. Compliance requires documented evidence of implementation, not just policy statements. For physical security, entities must assess facility threats, implement proportionate measures, and maintain regularly reviewed security plans.

What does a SCEC Endorsed consultant do?

A SCEC Endorsed consultant is authorised to provide security zone advice for facilities handling classified information, including zone boundary design, construction specifications per ASIO Technical Notes, access control configurations, emanation security, and zone inspection and certification. Core42 holds SCEC Endorsed status, enabling security zone consulting for government and defence facilities handling information at the required classification levels.

How does Core42 handle classified projects?

Core42 operates with appropriate security clearances and maintains secure work practices for classified engagements: compartmentalised information environments, documentation at appropriate classification levels, and project communications per PSPF and agency-specific requirements. Where projects involve personnel at different clearance levels, deliverables are structured so each team member receives only information relevant to their clearance and role.

Talk it through with a principal

A 30-minute diagnostic call is the fastest way to test whether your project’s security posture holds up. No deck, no pitch.

Book a diagnostic call Start the benchmark