PSPF Direction 002-2026 — Strengthening Commonwealth Cyber Posture Against AI-Enabled Risks (Secretary Stephanie Foster PSM, Department of Home Affairs; September 2026; PDF fetched this pass) directs all non-corporate Commonwealth entities subject to the PGPA Act. By 31 March 2027 entities must: (1) conduct a Legacy Technology Stocktake of all legacy technology systems managed by or on behalf of the entity (agencies set depth/scope; prioritise public-facing services); (2) develop and maintain a Legacy Technology Risk Management Plan incorporated into the cyber security strategy and uplift plan (PSPF Requirement 0098), including a reduction target commensurate with risk appetite, prioritisation strategies, mitigations for retained legacy, and procedures to rationalise the estate; (3) report stocktake completion and provide the plan to Home Affairs Commonwealth Security Policy Branch (PSPF@homeaffairs.gov.au).

Separately, by 31 December 2026 entities operating Systems of Government Significance (SoGS) must also incorporate SoGS Risk Reduction Measures from Policy Explanatory Note 002-2026 and report SoGS legacy stocktake completion. Further detail: Policy Explanatory Note 002-2026 to be issued by 13 October 2026 plus Home Affairs advisory sessions; entities should also apply Policy Advisory 001-2026 — Cyber Security Readiness in the Frontier AI Era.

Direction framing: frontier-AI capabilities have targeted the Commonwealth technology estate; continued vulnerable legacy plus accumulated exploitable vulnerabilities poses an unacceptable risk; strengthen vulnerability/patch management recognising shortened time from discovery to exploitation; prioritise SoGS resilience. Wires: iTnews / Canberra Times 30 Sep. Primary: PSPF Direction 002-2026 PDF.