PSPF Direction 002-2026 and legacy modernisation
Instrument
PSPF Direction 002-2026: strengthening Commonwealth cyber posture against AI-enabled risks, issued under the Protective Security Policy Framework.
Type and status
Mandatory Direction for applicable Commonwealth entities. This briefing summarises orientation only. The Direction text is authoritative for scope and requirements.
Applicability and dates
Applies to entities bound by the PSPF as stated in the Direction. Do not infer applicability to state, territory or private sector organisations without separate legal analysis. Confirm all dates and implementation requirements in the primary Direction and explanatory materials at the time of your assurance activity.
Practical institutional implications
The Direction requires Australian Government entities to reduce cyber security risks arising from vulnerable legacy technology systems and to strengthen cyber posture across Australian Government systems in the context of AI-enabled risks (per the PSPF publications library summary and official announcement).
Read the Direction PDF for required actions. The official PSPF announcement references Policy Explanatory Note 002-2026 and Policy Advisory 001-2026; this briefing does not summarise those documents. Modernising or replacing vulnerable systems still requires clarity on who may act, on what evidence, and with what accountability for institutional outcomes.
DataMPowered interpretation
DataMPowered's editorial proposition (interpretation, not a PSPF requirement) is that modernisation should preserve institutional capability: retain control of rules, authoritative knowledge, decision rights and operating continuity when mechanisms change. Technical assurance of new components complements, and does not replace, governance of consequential work. Cross-read machine navigability and institutional authority for how exposure can increase when estates become easier to traverse without stronger establishment and accountability.
Primary sources
Use the PSPF publications library entry and official announcement linked in the frontmatter. Re-check for superseding directions or amended explanatory notes before audit or board reporting.
Related reading
- Is AI easier to weaponise than to institutionalise? on asymmetric adoption of offensive capability versus institutional controls.