PSPF Ecosystem
Open Explorer
Local-first tools with Australian PSPF and ISM context

PSPF cyber risk and assurance

Connect risks, evidence, treatment work and accountability so a cyber security manager can decide what needs attention, follow through and explain the remaining exposure.

The current ecosystem has five VS Code extensions and the Explorer web app. Core holds the workspace record; Workshop supports authoring and reporting; Assurance tracks assessments and findings; Shop supplies commercial context; Pub keeps organisation records local. Explorer supports publication review and browser-local authoring through explicit bundle exchange.

These tools support the work that protects an organisation. They do not replace technical controls, monitoring or security testing, and completing an Action does not prove that risk has fallen. A coherent, context-preserving workbench is now being designed; the redesign is not implemented.

Install Core Install Workshop See workflow Open Explorer Atlas (home)
Recommended start path: Install Core and Workshop first. Then export a master bundle and open it in Explorer for reviewer-facing analysis. Pub records (people, teams, assignments) stay local and are not published to Explorer bundles.
1.76.0repository baseline; workbench redesign planned
1.17.0schema / bundle / API axes
5 + 1separate extensions and a web app
0cloud database dependency
Official sourcesPSPF, ISM, Essential Eight
Core + WorkshopLocal authoring and validation
Assurance + Shop + PubAssessment, commercial, and people context
ExplorerPublication-safe exchange only
Posture brief Master JSON Connected View Saved views Local backup

Current products

These remain separately packaged today. A single modular extension is under design review, not available as a replacement installation. Local records and publication-safe master bundles remain distinct.

C

Core

Marketplace

Local SQLite system of record, validation, snapshots, controlled import/export and writer ownership. The publication bundle excludes sensitive fields and is not a lossless backup.

VS Code extensiontobyharvey.pspf-corelocal-only
Install Core →
W

Workshop

Marketplace

Day-to-day requirements, evidence, cyber risks and treatment Actions, with team accountability, planning, strategy context and reusable reporting.

VS Code extensiontobyharvey.pspf-workshopdepends on Core
Install Workshop →
A

Assurance

Marketplace

Local assessment and penetration-testing workbenches, finding queues and verification/retest tracking. Secure assurance publication remains separately planned.

VS Code extensiontobyharvey.pspf-assurancedepends on Core
Install Assurance →
E

Explorer

web

Browser-based publication review and local authoring, with posture, records, relationships, saved views and copyable briefs. Work moves through explicit master-bundle exchange, not a live Core connection. Desktop and browser responsibilities are part of the new design review.

browser viewreads JSON bundleno server store
Open Explorer →
S

Shop

Marketplace

Commercial planning for suppliers, contracts, spend items, forecast review, and assurance-linked commercial context.

VS Code extensiontobyharvey.pspf-shopdepends on Core
Install Shop →
P

Pub

Marketplace

People, role, team, assignment, and stakeholder relationship foundation for local-only staff context, organisation charts, action badges, and responsibility signals. Pub records stay local and do not publish to Explorer bundles.

VS Code extensiontobyharvey.pspf-pubdepends on Core
Install Pub →

Workflow

Current tools support assessment, linked work and reporting. The complete connection from delivered work to observed treatment effect and reviewed business risk is still being developed.

Step 1

Capture locally

Use Core, Workshop, and Assurance to maintain assessment state, evidence, actions, risks, Directions, ISM mappings, pentest findings, verification queues, and planning context.

Step 2

Decide and mitigate

Record the assessment, evidence and rationale, then link Actions and controls to the work they support. Existing suggestions help identify requirement gaps without open work; the curated standard mitigation library remains planned.

Step 3

Review and explain

Use saved records and evidence to prepare a scoped brief, or review an eligible bundle in Explorer. Keep delivery progress, verification results and the remaining risk separate; missing evidence is a gap, not a successful outcome.

Design direction

Planning only, recorded 26 September 2026. The goal is one coherent workbench for capture, investigation, follow-through and reporting, with substantial interface and visual redesign.

Continuity

Keep your place

The target is a stable worklist, contextual editing and related-item inspection that preserves filters, selection, scroll and focus. Recover local drafts after closing or restarting; explicit Save changes authoritative records. This full workflow is not yet implemented.

Progress

Know what changed

Distinguish work delivered, effectiveness checked and risk reviewed. Reuse accepted facts in management reporting, keep uncertainty visible and provide useful mitigation starting points without automating professional judgement.

Structure

One coherent workbench

Compare workbench-first and outcome-first layouts, and evaluate one modular extension bringing together Core, Workshop, Assurance, commercial and organisational functions. Desktop/browser scope and final packaging remain open decisions.

There are no active users, so the proposed design can start with a fresh workspace without legacy retention or migration. That does not authorise deleting current data or weakening future privacy and recovery. Product-owner walkthroughs will test complete journeys, including interruption and failed Save; they are not a claim of active-user validation. No code, packaging or publication change is announced here.

Strategy: risk → priority → choice

The Workshop Cyber Strategy Map uses linked risk to help explain planning priorities. These are decision aids, not measured reductions in exposure. Known treatment-link and effectiveness-measurement gaps remain open in the wider risk-to-outcome workflow.

Risk drives priority; priority drives choices

Linked risk severity (likelihood × impact) is adjusted by the choice's trend and confidence. The peak adjusted risk sets the choice's priority band. Nothing is persisted — it is a derived read model over existing data.

Linked risks Priority scoring Strategic choice Risk severity likelihood × impact Choice signals trend & confidence Peak adjusted score severity + trend + confidence most pressing linked risk wins Critical ≥ 28 High ≥ 20 Medium ≥ 10 Low ≥ 1 Choice focus top blockers + rationale

How it works

Core-backed records, Pub's private local store and Explorer's browser data have different boundaries. These diagrams summarise relationships and exchange; a connection does not grant permission to publish the linked data. Master-bundle exchange is not a lossless workspace backup.

Data flow lifecycle

Official sources stay separate from assessment data. Workshop, Assurance and Shop use Core's SQLite record. Pub has a separate local store; only opted-in team dates supply Workshop planning context. Explorer receives an eligible master bundle, not the private workspace.

Authoritative sources Local workspace (your machine) Publication PSPF policy requirement statements ISM OSCAL snapshot controls, mappings Essential Eight maturity reference read-only reference → Core workspace SQLite system of record Domain · Requirement · Evidence Action · Risk · Direction · Link Workshop authoring & assessment Assurance findings · verification Shop suppliers · contracts · spend Pub separate local people store Validate & snapshot writer lock · schema · redaction publication boundary → Master JSON bundle manifest + entities + links schemaVersion · bundleVersion redacted by default Explorer (browser) posture · records · Connected View reviewed bundle import (not a backup)

Entity model

Every record has a stable prefixed ID and a typed link to other records. Domain anchors the assessment; Requirement is the hub; Evidence, Action, Risk, and Direction carry the assurance work.

Requirement REQ-* assessment status · effectiveness Domain DOM-* policy grouping ISM control ISM-* from OSCAL snapshot Evidence EVD-* freshness · verification Action ACT-* status · priority Risk RSK-* treatment status Direction DIR-* scope · cadence Shop · commercial Supplier SUP-* Contract CON-* Spend SPD-* linked to Requirement / Action for assurance context Pub · workforce (local only) Person PER-* Team TEM-* Role ROL-* Assignment (ASM-*) — never crosses to Explorer Assurance · local work queues Assessment local surface Verification readiness queue Tag · Link tagged-with · derived-from · supports groups maps supports addresses raised-by governed-by assigned-to (local)

Publication boundary

Every field needs a publication policy. Restricted personal data never crosses this boundary; sensitive fields are excluded by default. Being linked to a requirement does not make data public.

Crosses to Explorer

  • Eligible public fields in Domain, Requirement, Evidence, Action, Risk and Direction records
  • ISM mappings and Essential Eight references
  • Only the fields allowed by the active publication profile
  • Compatible risk assessments; unsupported assessments fail publication preflight
  • Eligible tags, saved views and link relationships
  • Public snapshot summaries and redacted posture brief content

Not in Explorer bundles

  • Person names, emails, and any personal contact data
  • Assignment records (ASM-*) and team membership
  • Restricted-field values and non-public free text
  • Raw penetration testing notes, exploit detail, and internal verification working material
  • Non-public notes and Shop commercial data without an approved publication policy
  • Workspace database and private snapshot side files