What are PSPF security zones?

PSPF Release 2026 took effect on 1 July 2026 and made two changes to physical security: SCIFs were added to the Security Zones table, and Requirement 0199 now gives their accreditation to ASD. Every other physical requirement, dated 31 October 2024, carried over. The table and requirement numbers below come from the Release 2026 PDF.

The reading repeated most often is "Zone 4 = PROTECTED". The PSPF says something more useful. Its Table 22 lets PROTECTED technology assets sit in any zone from Two to Five, and trades the zone against the container: the higher the zone, the less the cabinet has to do. A data hall designer who knows that table has three workable options instead of one.

Three terms carry the rest. A Security Zone is a restricted access area defined by the PSPF; the PSPF writes the numbers as words, Zone One to Zone Five, while operators and search engines write Zone 1 to Zone 5. Certification confirms that a zone's controls are in place and working. Accreditation is the later decision to operate the zone, made when someone with authority accepts the residual risk. "SCEC zones" is common search language for the same thing; the Security Construction and Equipment Committee does not define the zones.

Why PSPF security zones matter

Security Zones are how the PSPF turns physical protection into areas a person can walk into or be kept out of. The framework's physical chapters start from five layers of physical security, deter, detect, delay, respond and recover (s 23.2), and then say facilities are designed "according to the five Security Zones, with increasing restrictions and access controls as the zones progress from Zone One to Zone Five". The zones exist mainly to protect security classified information (s 24.1), and entities must certify and accredit every area where that information will be used, transmitted, stored or discussed (s 24.2).

Data centres are not an afterthought in that scheme. Section 13.8 defines a technology asset storage facility and lists what it includes, and datacentres are on the list. Three requirements then decide where the equipment inside sits.

The rules reach further than the Commonwealth's own buildings. The PSPF binds Commonwealth entities, and it reaches a commercial operator through them. Requirement 0111 tells entities to host security classified information on cloud or data centre services certified under the Hosting Certification Framework, which the HCF guide covers. Requirement 0096 has outsourced facilities that house catastrophic-impact assets certified by ASIO-T4 and accredited by ASD before use. ASIO's Protective Security Circular 149, "Physical security certification of outsourced ICT facilities", sits on GovTEAMS and is not public. And ASD's Information Security Manual (ISM), the other document a data centre answers to, sends its readers back to the PSPF for certification authorities, zone requirements and the choice of zones and containers for IT equipment.

The physical domain is small enough to read in an afternoon. Release 2026 holds 22 physical requirements, numbered 0189 to 0210. All of them are dated 31 October 2024 except 0199, the SCIF requirement, dated 1 July 2026. A data centre that hosts government systems will be asked about most of them, usually by a customer's security adviser holding a copy of Table 40.

How PSPF security zones work, step by step

A zone has a life: it is chosen, built, certified, accredited, operated and recertified. Each stage has its own requirement number and its own decision-maker.

The five zones and who can enter each

Table 37 sets the restricted access rules and Table 38 adds the clearance each person needs for ongoing access. Read across a row and the zone's character is clear: Zone One is open to the public, Zone Two keeps the public on a restricted footing, Zone Three removes the public and escorts visitors, Zone Four adds the clearance requirement, and Zone Five adds dual-factor authentication and refuses temporary access except in Exceptional Circumstances.

Two details catch operators out. Zones Three, Four and Five share the visitor rule, so an escorted visitor with a need-to-know is lawful in all three; what changes is the clearance and the authentication. And Zone Four is described as an "entity restricted office area", the same words as Zone Three. The difference is the clearance column: in Zone Four, authorised personnel hold the clearance for what is stored there.

Choosing the zone for a data hall

Requirement 0094 decides the zone: technology assets classified SECRET or below sit in the Security Zone that matches their aggregated classification or business impact level. The word that matters is aggregated. A rack of OFFICIAL: Sensitive systems can aggregate to a higher impact, and the zone follows the aggregate, not the label on any one system. TOP SECRET equipment has its own rule: SCEC-endorsed racks or compartments inside an accredited Zone Five area (Requirement 0095).

Table 22 then gives the container for each pairing of impact level and zone.

The PROTECTED rows are the ones most data centre conversations turn on. In Zone Two, PROTECTED equipment needs a SCEC Class C container; in Zone Three, Class C is recommended; in Zones Four and Five, a lockable commercial cabinet is enough. None of those rows is the "right" zone. The choice is a cost trade between building a higher zone and buying heavier containers, made in the entity's security risk assessment.

Table 23 adds layering. When the equipment room is its own Security Zone inside an existing one, the container requirement can drop. A PROTECTED data hall built as a Zone Three room inside a Zone Two floor can use lockable commercial cabinets, where the same equipment on the open Zone Two floor would need SCEC Class C. The ISM describes the same idea as three layers: a zone suited to the classification, an additional zone for the server or communications room, and security containers.

Building to the zone

The lifecycle requirements read in order. Protective security is built into planning, selecting, designing and modifying facilities (Requirement 0189). A facility security plan is required for new facilities, facilities under construction and major refurbishments (Requirement 0190), and site decisions use the Table 36 factors: neighbourhood, standoff perimeter, site access and parking, building access points, Security Zones and environmental risks (Requirement 0191). Table 36's building access factor includes emergency exits, air intakes and outlets and service ducts, which is where a data hall's plant usually breaches the zone line.

Construction follows the ASIO Technical Notes (Requirement 0193). Zones Two to Five that handle classified material are built to ASIO Technical Note 1/15 and Technical Note 5/12 (Requirement 0194). Those notes sit on GovTEAMS, so the people who design to them are the entity's security practitioners and the consultants who hold access. Once built, the facility is operated and maintained in line with the zone's controls (Requirement 0195).

Certification and accreditation

Certification comes first. Table 40 sets the certification authority control by control, zone by zone, and the pattern is worth learning because it decides who must sign what before go-live.

The entity's Chief Security Officer (CSO), or a delegated security practitioner, signs the risk assessment, the site security plan and the zone requirements in every zone. Specialist parts are certified by people outside the entity: a suitably qualified installer or designer for a commercial alarm in Zones One to Three and for the electronic access control system in every zone, and a SCEC-endorsed Security Zone consultant for the SCEC-approved Type 1A alarm in Zones Four and Five. The access control line carries a condition operators often miss: current software patches and no obsolete components. The final certification, including a site inspection, is the CSO's for Zones One to Four and ASIO-T4's for Zone Five (Requirements 0196 and 0197).

Accreditation follows. Table 41 makes the CSO or delegate the accreditation authority for Zones One to Five once the controls are certified, and Requirement 0198 says each zone is accredited before operational use, on the basis that the controls are certified and the entity determines and accepts the residual risks. Approval runs for a specified time. SCIFs are the exception: ASD accredits them under the National SCIF Accreditation Program (Requirement 0199).

Where SCEC fits

The Security Construction and Equipment Committee is a standing inter-departmental committee whose schemes are managed by ASIO's T4 Protective Security. It has three jobs relevant to a zone, and defining the zone is not one of them.

Equipment is where most data centres meet SCEC. Evaluated products are rated SL1, the lowest acceptable level for government use, to SL4, and approved items are listed in the Security Equipment Evaluated Product List on GovTEAMS. Commercial equipment that meets Australian and international standards may be used where the confidentiality impact is below medium, and ASIO-T4's Security Equipment Guides cover equipment SCEC has not tested (s 25.1). For alarms, Type 1A systems cover SECRET, TOP SECRET and certain codeword information, while commercial alarms are graded under AS/NZS 2201.1: Classes 1 and 2 for domestic use, Classes 3 and 4 for normal business, and Class 5 up to an extreme impact (s 25.6). Standards Australia lists the 2007 edition as Pending Revision; it is still the edition the PSPF cites.

What "ASIO-T4 certified" means

Operator marketing often says a facility is "ASIO-T4 certified". Under Release 2026 that phrase has two possible meanings. One is a Zone Five area holding TOP SECRET or catastrophic-impact aggregates, which ASIO-T4 certifies (Requirement 0197). The other is an outsourced facility housing technology assets with a catastrophic business impact, which ASIO-T4 certifies and ASD accredits before use (Requirement 0096). Neither covers Zone Four, which the CSO or delegate certifies. When a provider makes the claim, ask which area was certified, under which requirement, on what date, and who accredited it.

Recertification

Certification is time-limited, and the assessment is specific to the facility's role and contents at the time (s 24.2.3). Four kinds of event trigger recertification and reaccreditation: expiry with the passage of time; a change in the business impact level of what the zone holds; significant changes to the facility's architecture or its physical security controls; and any other condition the Accreditation Authority stipulated, such as a change in threat level.

The steps in order

A worked example: a PROTECTED data hall in a Commonwealth entity's own building

Kingfisher Records Agency is a non-corporate Commonwealth entity in Canberra with about 600 staff. Its PROTECTED case management systems run from a communications room on level 2 that has outgrown its power and cooling. The name and the figures are fictional; the requirements are not.

The decision to build. In March 2026 the agency decided to fit out a data hall, L3-DH, on level 3 of its own building. The fit-out is a major refurbishment, so the security adviser wrote a facility security plan (Requirement 0190) and walked the Table 36 factors. The building access factor found the issue that shaped the design: the hall's cooling needed new air intakes and a service duct to the roof plant, both crossing the line any new zone would draw.

The zone. The hall would hold the case management systems, their backups and the records index, which aggregate to PROTECTED with a high business impact. Level 3 is a Zone Two office floor. Table 22 offered three paths: keep the equipment on a Zone Two footing in SCEC Class C containers, build the hall as Zone Three with Class C recommended, or build to Zone Four and use lockable commercial cabinets. Table 23 offered a fourth: a Zone Three room inside the Zone Two floor, with lockable commercial cabinets. The agency chose the fourth, because the racks it was buying were commercial cabinets and the walls had to be built either way.

Building it. The hall was built to ASIO Technical Note 1/15 (Requirement 0194), with the duct and air intake penetrations treated in the same design. Zone Three needs no Type 1A alarm, so a commercial alarm system went in, graded under AS/NZS 2201.1, and the installer certified it and the electronic access control system. The installer's certificate confirmed current software patches and no obsolete components, as Table 40 requires.

Two signatures. The CSO's delegate inspected the hall on 14 August 2026 and certified the zone (Requirement 0196). The CSO accredited it on 21 August 2026 after reading the certifications and accepting two residual risks in writing: the shared lift lobby on level 3, and a six-week wait for a second alarm communication path (Requirement 0198). The hall went live on 1 September 2026.

The ISM view. The agency's PROTECTED systems now sit inside the ISM's three layers: the Zone Two floor as the first, the Zone Three hall as the additional zone for the server room (ISM-1053), and the cabinets as the third. The hall is never left unsecured (ISM-0813), and the screens on the operations console face away from the corridor glass so unauthorised people cannot observe them (ISM-0164).

The disaster recovery site. The agency's recovery environment runs at Ridgeline Data Centres, a commercial operator, so Requirement 0111 applies: the service is certified under the Hosting Certification Framework, and the agency bought the space through the Data Centre Facilities Supplies Panel (Requirement 0112). The HCF guide follows the same operator from its side.

What will trigger recertification. The accreditation sets the certificate's end date, and the security adviser keeps a log of the other triggers.

The second trigger is the instructive one. A SECRET system would change the business impact level, and Table 23 has no SECRET row for a Zone Two primary zone. The answer would be a redesign before the system arrives, not a new cabinet.

Common mistakes

Most errors come from operator shorthand and from reading Release 2025 after it was replaced. Here are six readings against the text.

1. Treating "Zone 4 = PROTECTED" as the rule. Table 22 permits PROTECTED in Zones Two to Five and trades zone against container. Decide the pairing in the security risk assessment, then build it.
2. Saying ASIO-T4 certifies Zone Four. The CSO or delegate certifies Zones One to Four (Requirement 0196). ASIO-T4 certifies Zone Five areas holding TOP SECRET or catastrophic aggregates and catastrophic-impact outsourced facilities (Requirements 0197 and 0096).
3. Writing "SCEC zones" as though SCEC sets them. Use the phrase to be found, then cite the PSPF and the ASIO Technical Notes for the rule.
4. Assuming a SCEC-endorsed consultant must design every zone. One is required for Type 1/1A alarm design, acceptance testing and commissioning, and certifies the Type 1A alarm in Zones Four and Five. Zone design and construction does not need one.
5. Reading the label instead of the aggregate. Requirement 0094 asks for the aggregated classification or business impact level. Add up what the room holds, including backups, before choosing the zone.
6. Letting access control age out. Table 40 requires current software patches and no obsolete components in the electronic access control system, and a significant change to controls triggers recertification. Track the head-end's support dates like any other system's.
7. Treating certification as permanent. It is time-limited (s 24.2.3). Log the triggers and diarise the expiry.
8. Quoting Release 2025. Release 2026 superseded it on 1 July 2026 and added Requirement 0199 for SCIFs.

PSPF security zones compared with their neighbours

Most confusion about zones disappears when each nearby term is sorted by what it is: a rule for an area, a rule for equipment, a certifier, or a different regime.

The SOCI physical security post covers the last row, and the audit checklist maps all of these onto one walk from site to rack.

Standards and references

PSPF Release 2026, issued 1 July 2026. Read s 13.8 and Tables 22 and 23 for technology asset storage, s 15.2 for hosting, chapter 23 for the lifecycle requirements and Tables 36 and 37, chapter 24 for Tables 38, 40 and 41 and recertification, and chapter 25 for SCEC equipment and alarms. Release 2025 is superseded and still sits in the publications library.

PSPF Release 2026 Summary of Changes. Confirms the two physical-domain changes: SCIF content in Table 38 and the new Requirement 0199.

ASIO Technical Notes 1/15, 5/15 and Annex A of 5/12, ASD's SCIF Accreditation Standards and ASIO Protective Security Circular 149. The construction and certification detail behind the zones, all on GovTEAMS. The PSPF cites TN 5/12 in Requirement 0194 and TN 5/15 in its related standards for TOP SECRET areas.

ISM September 2026, Guidelines for physical security. Two sections, "Facilities and systems" and "IT equipment and media", with the three-layer model and controls such as ISM-0813, ISM-1074, ISM-1296, ISM-0164 and ISM-0161. The ISM is not legally binding unless legislation or a direction requires it.

SCEC. The Security Zone Consultant, Approved Locksmith and endorsed courier schemes, the consultant briefing, and the rule on when a consultant must be engaged.

AS/NZS 2201.1:2007, Intruder alarm systems. The grading the PSPF uses for commercial alarms, listed by Standards Australia as Pending Revision. The PSPF also names AS 1725.1 for chain-link security fencing, AS 3016 for electric security fences and AS 3809 for safes.

How Alvor helps

With Alvor, an entity or an operator keeps the record behind a zone in one place, so the certifier and the accreditor read the same evidence.

You can add any framework in Alvor. The PSPF's physical requirements go into Compliance through the framework builder in their own wording and numbering, with owners and evidence against each requirement, and the ISM can be built the same way in ASD's structure. ISO 27001:2022 installs from the framework library, with its 14 physical controls among the 93 in Annex A. A crosswalk maps controls between installed frameworks, so the evidence behind a PSPF requirement is the evidence behind its ISO 27001 counterpart, and each framework is still assessed on its own wording. Evidence is uploaded or linked once, carries a valid-until date, and is reused across the controls it supports, which suits alarm service records and installer certificates that expire.

Accreditation turns on accepted residual risk, and Risk Management is where that acceptance lives. Each risk is scored on likelihood and impact against criteria you set, and an accepted risk carries its conditions, scope and expiry, like the lift lobby and the alarm path Kingfisher's CSO accepted. Asset Management records each asset's dependencies and its end-of-life and end-of-support dates, so an access control head-end approaching end of support shows up before it becomes an obsolete component under Table 40. Each asset's data record holds its classification. History is hash-chained, so the dates on certifications and reviews stand up later.

Alvor runs as a dedicated single-tenant instance in the Sydney region (ap-southeast-2), on your own servers, or air-gapped. The AI Assistant is bring-your-own-model, including self-hosted models, and a person accepts or rejects every change it proposes.

For the facility itself, Alvor Advisory's data centre physical security work assesses the facility against the PSPF, the ISM, SOCI and customers' audits, designs the boundaries and zone layout with the Commonwealth entity, and prepares the evidence. Where construction must follow the ASIO Technical Notes, we design with the SCEC-endorsed consultant or adviser who works from them. Certification stays with the authority the PSPF names.