Commonwealth entities
PSPF Direction 002-2026: legacy technology stocktake and risk plan
The Department of Home Affairs has directed non-corporate Commonwealth entities to find and manage their legacy technology. We help agencies complete the stocktake, build a defensible Legacy Technology Risk Management Plan and understand the information each legacy system holds.
Key dates
31 Dec 2026
Entities with Systems of Government Significance: stocktake of those systems and risk reduction measures
31 Mar 2027
All non-corporate Commonwealth entities: full stocktake, risk management plan and report
What the Direction requires
PSPF Direction 002-2026, Strengthening Commonwealth Cyber Posture Against AI-Enabled Risks, was published in late September 2026. It responds to frontier AI capabilities that have targeted the Commonwealth’s technology estate and describes vulnerable legacy systems as an unacceptable risk to Australian Government operations.
For non-corporate Commonwealth entities under the PGPA Act, the Direction requires:
- By 31 December 2026, entities operating declared Systems of Government Significance incorporate the SoGS Risk Reduction Measures and report completing the legacy stocktake for those systems.
- By 31 March 2027, a Legacy Technology Stocktake of every legacy system the entity manages or that is managed on its behalf, prioritising public-facing services.
- By 31 March 2027, a Legacy Technology Risk Management Plan linked to the entity’s cyber security strategy and uplift plan, with a reduction target, prioritisation, mitigations for systems that remain and procedures to rationalise the estate.
- By 31 March 2027, a report of stocktake completion and a copy of the plan to the Department’s Commonwealth Security Policy Branch.
- Stronger vulnerability and patch management across the whole technology estate.
Each entity sets its own reduction target in line with its risk tolerance and decides the depth of its assessment. An Accountable Authority can seek an exemption from reporting for national security functions, but that does not remove the need to do the stocktake or hold the plan.
What counts as legacy technology
A product is legacy if it meets at least one criterion in each of two categories, drawn from PSPF section 13.7:
Vendor: end of life, out of support or on extended support.
Entity: impractical to update or support in-house, no longer cost-effective, above the acceptable risk threshold, offering diminishing business value, or obstructing IT strategy.
How we help agencies get it done
Mobilise and scope
Agree the boundary, owners and evidence sources, including systems managed by providers and shared services, and plan around the 31 December and 31 March milestones.
Discover
Combine the CMDB, licensing and vendor support data, network and endpoint discovery and interviews with system owners to build a complete list.
Classify against the PSPF criteria
Test each product against the vendor and entity criteria and record the reasoning, so the stocktake stands up to review.
Assess risk and the information inside
Rate each system for exposure, patch status, public-facing role and the sensitivity of the information it holds, including personal information and records with retention obligations.
Set the target and the plan
Work with the CISO and executive to set a reduction target that matches risk appetite, sequence remediation and define mitigations for systems that must stay.
Report
Prepare the completion report and plan for the Commonwealth Security Policy Branch, and a briefing for the Accountable Authority and audit committee.
Why an information governance lens matters
Legacy systems are rarely just a patching problem. They often hold years of records and personal information that cannot simply be switched off. Decommissioning needs a plan for what data moves, what is kept and what can lawfully be destroyed, including Commonwealth records that need authority under the Archives Act 1983 before disposal.
We bring information governance, privacy and data security together with the stocktake, so the plan you submit is one you can actually execute.
What you get
- a complete legacy technology register with PSPF classification and reasoning
- risk ratings that include data sensitivity and public exposure
- a Legacy Technology Risk Management Plan linked to your cyber uplift plan
- data migration, retention and disposal considerations for each system
- the completion report and an executive briefing pack
Frequently asked questions
Does Direction 002-2026 apply to corporate Commonwealth entities or the states?
No. It applies to non-corporate Commonwealth entities under the PGPA Act. Corporate entities, companies and state governments are outside its scope, although many will find the approach useful.
Who sets the reduction target?
Each entity does, in line with its own risk tolerance and appetite. There is no single Commonwealth-wide figure.
How deep does the stocktake need to go?
Entities decide the depth and scope of their assessment. It should be deep enough to support the reduction target and to defend your classification of each system.
What are the SoGS Risk Reduction Measures?
The Direction said they would be set out in Policy Explanatory Note 002-2026. Check the PSPF website or your PSPF contact for the current version before finalising your 31 December work.
Can you work alongside our existing cyber provider?
Yes. We often work with an entity’s security team and managed service providers, adding the discovery, classification, information governance and reporting work the Direction needs.
Source: PSPF Direction 002-2026, Strengthening Commonwealth Cyber Posture Against AI-Enabled Risks, Department of Home Affairs. This page is general information, not legal advice.
Need help before 31 December?
Talk to us about a focused stocktake sprint for your Systems of Government Significance, then the full estate by 31 March 2027.