We have introduced performance measures of the Classification System into the PSR Capability Maturity Model, Self-Assessment process, and moderation framework.  You may already be using these tools to measure your protective security performance today. There have been a few additional indicators added that you will use going forward.

Measurement for PSR mandated agencies 

• PSR mandated agencies will first be assessed against the changes in March 2024.  The table below shows the key actions required of PSR-mandated agencies. 
• Agencies will typically begin gathering evidence in around November each year to be ready to submit their self-assessment in March the following year.  By this assumption, PSR-mandated agencies will need to have made any required changes by the end of October 2023 in order for these to be captured in the March 2024 self-assessment.  
• This gives agencies about 16 months to make changes once the new policy is introduced.  Agencies will need to make their own assessment about how much change is realistic.  For example, an agency may choose to target a ‘basic’ maturity level, if it does not think it has the resources to meet all the requirements of a higher maturity level. 

Measurement for all others

• Agencies that are not PSR mandated are not required to complete the self-assessment process.  However, the PSR guidance and self-assessment requirements do give a clear indication of what best practice looks like. 
• All agencies are encouraged to consider these requirements against their own business needs and to consider what changes they may need to adopt to better manage their protective security.