Public Sector Zero Trust Roadmap: PSPF & ISM Aligned
The 2025 PSPF update mandates a Zero Trust mindset for every Australian government agency. Intrix delivers public sector zero trust readiness assessments and a practical, phased adoption plan aligned with the ISM.
The PSPF Mandate: Zero Trust is Here
The 2025 update to the Protective Security Policy Framework (PSPF) represents a paradigm shift in government security. Zero Trust principles are now a mandatory component of cybersecurity strategy. This “never trust, always verify” model is a critical defense against sophisticated state-sponsored actors.
For many agencies, this is an incredibly difficult transition. How do you implement Zero Trust when you’re encumbered by legacy systems and traditional, perimeter-based network designs?
Paradigm Shift
Moving from “trust but verify” to “never trust, always verify” requires fundamental changes to architecture, processes, and mindset
Legacy Complexity
Government agencies must modernise while keeping services running often on aging systems and legacy network architectures
Mandatory Compliance
The PSPF 2025 update makes Zero Trust mandatory, requiring agencies to demonstrate progress and implementation
Our Solution: The Intrix Public Sector Zero Trust Readiness Assessment & Roadmap
Intrix acts as your strategic guide, demystifying Zero Trust and presenting a practical, phased approach that is achievable even in complex government environments. We are your Zero Trust transformation partner
Zero Trust Readiness Assessment
We assess your current security architecture and maturity against core Zero Trust principles—reviewing identity, access, network design, data protection, device security, and monitoring readiness
Architecture Assessment
Gap Analysis
Maturity Evaluation
PSPF Alignment
A Practical, Phased Roadmap
We deliver a customised, phased roadmap for adoption that is fully aligned with the PSPF and ISM. Our approach breaks down the transformation into manageable phases that can be implemented incrementally without disrupting operations
Phased Implementation
Risk Prioritisation
ISM Compliance
Business Continuity
Core Zero Trust Principles
Verify Explicitly
Always authenticate and authorise based on all available data points including user identity, location, device health, service or workload, data classification, and anomalies
Least Privilege Access
Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA), risk-based adaptive policies, and data protection to help secure both data and productivity
User Application Hardening
Minimise blast radius and segment access. Verify end-to-end encryption & use analytics to get visibility, drive threat detection
Continuous Verification
Trust is never implicit and is continuously evaluated through real-time monitoring, behaviour analytics, and adaptive authentication
Zero Trust Implementation Pillars
Identity & Access
Strong identity is the foundation of Zero Trust
Multi-factor authentication
Get access management
Conditional access policies
Identity governance
Device Security
Ensure devices meet security standards
Device compliance verify
Mobile device management
Endpoint detection
Patch management
Network Segmentation
Micro-segmentation and isolation
Micro-segmentation
Network access control
Software-defined
East-west traffic filtering
Data Protection
Encrypt and classify sensitive data
Data classification
Encryption in transit
Data loss prevention
Information rights
Application Security
Secure applications and workloads
Application access controls
Container security
API security
Secure development
Visibility & Analytics
Monitor, detect, and respond to threats
Security information
Threat intelligence
User and entity behavior
Automated response
Why Public Sector Agencies Choose Intrix for Zero Trust
Practical, Not Theoretical
Our roadmaps are designed for real-world implementation in complex government environments, not ivory tower theory
Government Security Expertise
Deep understanding of PSPF, ISM, and government security requirements with proven experience implementing Zero Trust in public sector environments
Phased Implementation
We break down the transformation into achievable phases that deliver value incrementally while maintaining operational continuity
Transformation Partner
We work alongside your team as a transformation partner, not just as consultants who deliver a report and leave
Zero Trust FAQ
How long does Zero Trust implementation take?
Initial Zero Trust controls can be deployed within weeks, while full architectural maturity typically takes two to three years. Zero Trust is a continuous journey rather than a project with a fixed end date, and Intrix works with agencies to prioritise high-value assets and critical systems first, building a phased roadmap that delivers measurable security improvements at each stage without disrupting service delivery. Progress is benchmarked against ASD’s Foundations for Modern Defensible Architecture throughout.
How is Zero Trust different from the Essential Eight?
The Essential Eight is a baseline set of technical mitigation strategies focused on patching, application control, and backups. Zero Trust is a broader architectural model built on continuous verification of identity, devices, and access across the entire environment. Most agencies need both, the Essential Eight provides foundational technical controls, while Zero Trust governs how access and trust are managed across the organisation as a whole.
How much does a Zero Trust readiness assessment cost?
Pricing depends on the size of your environment, the number of systems and locations in scope, and how much legacy infrastructure needs to be assessed. Most agencies start with a scoped readiness assessment, priced after an initial discovery call, before committing to a full phased roadmap.
What is Zero Trust and why is it important for government?
Zero Trust is a security model based on never trust, always verify. It’s critical for government because traditional perimeter-based security is ineffective against sophisticated state-sponsored actors who can bypass or compromise network boundaries. The 2025 PSPF update mandates Zero Trust principles.
Can we implement Zero Trust with our legacy systems?
Yes. Zero Trust does not require wholesale replacement of legacy systems and can be implemented progressively by layering controls around existing infrastructure. The most effective starting point is identity, deploying multi-factor authentication and least-privilege access controls, which can be applied without modifying legacy code. Where legacy applications cannot support modern authentication directly, Intrix uses gateway and proxy approaches to enforce Zero Trust policies at the network boundary while modernisation is planned in parallel.
How does Zero Trust align with the ISM and PSPF?
The PSPF 2025 Annual Release formally mandates Zero Trust adoption for all non-corporate Commonwealth entities under PSPF Requirement 0098, requiring agencies to develop a cybersecurity strategy and uplift plan aligned with both the Information Security Manual and the Guiding Principles to Embed a Zero Trust Culture. The ISM provides the technical control framework that supports Zero Trust implementation, while ASD’s Foundations for Modern Defensible Architecture offers the architectural guidance that sits above both documents. Intrix maps Zero Trust implementation work directly to these frameworks to ensure agencies meet their PSPF compliance and annual reporting obligations.
Stop Struggling with Compliance
Contact Intrix for a practical, hands-on partnership to achieve your Essential Eight maturity and government cybersecurity compliance