PSPF Policy 14 — Cyber Security Strategies

Under PSPF Release 2025, Policy 14: Cyber Security Strategies is where non-corporate Commonwealth entities (NCEs) get their cyber floor. It carries forward the Essential Eight mandate that previously sat under the Policy 10 information-security line. Policy 14 is Attorney-General's Department protective-security policy, not an ASD technical standard by itself — the work still runs through ASD's Essential Eight Maturity Model and the ISM.

Since 1 July 2022, Policy 14 requires NCEs to implement all eight Essential Eight strategies to at least Maturity Level 2, and to consider whether their threat environment warrants Level 3. ASD's Commonwealth cyber security posture reports (2024 and 2025) restate that duty. The eight: application control; patch applications; configure Microsoft Office macro settings; user application hardening; restrict administrative privileges; patch operating systems; multi-factor authentication; and regular backups.

Maturity is not an average. ASD and the posture reporting are explicit: a network's overall maturity equals its least mature strategy. If MFA looks polished and application control is at 0, you are at 0. Plan and evidence the package together. Policy 14 also expects entities to consider which of the remaining Strategies to Mitigate Cyber Security Incidents (beyond the Essential Eight) are required for their threat picture — that is a risk decision with an owner, not a checkbox.

Evidence and reporting sit with the PSPF Release 2025 list of requirements (AGD spreadsheet) and ASD's annual Commonwealth cyber security posture survey. Map each strategy to scope, configuration artefact, last-checked date, and owner. Exceptions expire in writing. Corporate Commonwealth entities and industry suppliers are not automatically NCEs, but Policy 14 language is the dialect boards and contracts use when they say 'Essential Eight ML2'.

Use this page with the PSPF overview, Essential Eight evidence, and IRAP pages. For the control catalogue underneath the floor, use the ISM. For the annual survey and posture numbers, use ASD's Commonwealth cyber security posture publications on cyber.gov.au.

Direction 002-2026 (Secretary, Home Affairs; September 2026) is the PSPF lever for frontier-AI risk to legacy Commonwealth systems. By 31 March 2027 every non-corporate Commonwealth entity must finish a Legacy Technology Stocktake (prioritise public-facing services), write a Legacy Technology Risk Management Plan into its cyber security strategy and uplift plan (PSPF Requirement 0098), and report both to the Commonwealth Security Policy Branch. The plan needs a reduction target, prioritisation, mitigations for systems you keep, and rationalisation procedures.

SoGS operators have an earlier clock: by 31 December 2026 incorporate the SoGS Risk Reduction Measures from Policy Explanatory Note 002-2026 (Home Affairs said the note would issue by 13 October 2026) and report SoGS legacy stocktake completion. Read Direction 002-2026 with Policy Advisory 001-2026 (Cyber Security Readiness in the Frontier AI Era). Patch critical vendor findings faster — the Direction explicitly cites the shortened time from vulnerability discovery to exploitation. Desk card: home-affairs-legacy-stocktake-20260930. Primary: protectivesecurity.gov.au PSPF Direction 002-2026 PDF.