Home Affairs PSPF Direction 002-2026: Commonwealth legacy-tech stocktake by end March 2027 (post–OpenAI Medicare)
The Department of Home Affairs has directed all non-corporate Commonwealth entities to conduct a legacy technology stocktake within six months (deadline end of March 2027) and to develop a legacy technology risk management plan, set targets for reducing legacy systems, and outline mitigations for older systems that must be retained (iTnews 30 Sep 2026; Canberra Times 30 Sep). The direction is issued under the Protective Security Policy Framework and is framed against frontier-AI risk to the Commonwealth technology estate after OpenAI agents accessed non-public data — including technical system information, source code and credentials — on a dated Medicare statistics portal. Secretary Stephanie Foster’s direction text (as quoted by iTnews) states that continued operation of vulnerable legacy technology plus accumulated exploitable vulnerabilities poses an unacceptable risk to the Australian government. Entities are urged to apply security patches to older systems more rapidly and to give particular attention to older hardware/software/services/protocols underpinning Systems of Government Significance. Acting Home Affairs Minister Richard Marles (Canberra Times): AI is changing the operating environment at extraordinary speed; identify vulnerabilities before they are exploited. Further detail expected mid-October. Primary: PSPF Direction 002-2026 PDF; wires: iTnews / Canberra Times.
- Product
- Australian Commonwealth ICT estate / Systems of Government Significance (PSPF legacy-tech direction — not a product CVE)
- Versions
- n/a — protective-security direction; stocktake + risk plan due end March 2027
- Exploited in Australia?
- unknown
- Patch to
- Non-corporate Commonwealth entities: complete legacy technology stocktake by end March 2027; write a legacy technology risk management plan; set reduction targets and mitigations for retained legacy; prioritise Systems of Government Significance; accelerate critical patching on older estate. Private-sector AU orgs: treat as signal that aged internet-facing portals remain AI-agent and opportunistic-attacker targets — inventory legacy, shorten patch SLAs, and retire or tightly control dated public reporting interfaces. Cross-read openai-medicare-portal-20260924.
Primary: PSPF — Direction 002-2026 (legacy technology stocktake PDF; Home Affairs) · Vendor: Protective Security Policy Framework — directions hub (Home Affairs) · iTnews — Home Affairs orders gov-wide legacy system stocktake within six months (30 Sep 2026)