Our stocktake of the PSPF stocktake

Last month, I spoke at CyberCon, arguing that cyber practitioners need to lean in on AI. The questions after were sharp, one in particular: if we're all leaning in hard on AI, where does that leave the sovereign case for cyber?

That question also happens to be a kissing cousin to PSPF Direction 002-2026. So, let’s take stock of that stocktake first.

The easy half

On 29 September 2026, the Secretary of Home Affairs signed PSPF Direction 002-2026. By the end of March 2027, every non-corporate Commonwealth entity must complete a legacy technology stocktake and risk management plan. The Direction is attempting to anticipate future breaches, like the one that triggered the ask: where an OpenAI agent strolled into a Medicare statistics portal no one was watching.

Rajiv Shah’s October piece in ASPI Strategist response framed it neatly. Counting legacy systems is the easy part. Fixing them, less so. The question for cyber programs now: how do you move from a complete inventory to a workable plan, when the systems in it are legacy for reasons that haven’t gone away in a decade?

The harder half

Shah’s point is right, as far as it goes. But exactly how hard?

“Fixing has a structure, even if the finish is slow.”

Peter Soulsby, Director of Cyber Security & Government

Here's the model I'd use for the triage. Score each system in the stocktake on two axes.

Exposure: breach risk times impact if the breach landed.
Effort: the cost of migrating or replacing it in this budget cycle.

High exposure, low effort moves first. Low exposure, high effort waits. The two remaining quadrants are where the hard calls get made.

My view is to respond to those in two phases. Migrate what you can this cycle, sequenced by the triage score. For what you can't, compensate. And where even compensation leaves a gap, accept the residual risks formally.

The compensating controls are familiar to anyone who's managed legacy security in federal estates. Segmentation to limit blast radius. Auth proxy to add factor and control between the user and the system. Enhanced monitoring to shrink detection time to something an incident response team can work with. Dedicated security hardware between the system and the internet, where the architecture allows.

Of course, none of this is as satisfying as decommissioning a legacy system. But for systems that can’t move this cycle, this is the way.

Residual-risk acceptance is the piece most agencies find uncomfortable. Understandably so. A signed statement by someone with authority to hold the risk, on the record, that the agency knows it carries this exposure and will not close it this cycle is a heavy (but important) cross to carry.

Pick the right framework

This is where I part with the handbook: the Essential Eight is the wrong tool for most of what the stocktake will surface. The ACSC designed it for internet-connected Windows networks. The legacy estate sits outside that scope: bespoke applications on ageing platforms and systems locked to a vendor's own interface. Of the eight controls, only backups applies cleanly. Forcing the other seven onto legacy systems produces false maturity ratings, or stalls on controls that can't be implemented.

The ASD is replacing the Essential Eight with the Essentials series, with enterprise IT, OT and cloud as separate chapters. That will help. But this stocktake is due before the new chapters land.

The Information Security Manual (ISM) is the better fit. Risk-based controls are specific to each system. The stocktake should land there.

A new kind of legacy

“The sovereignty question I opened with is really a question about control. So is the PSPF stocktake.”

Peter Soulsby, Director of Cyber Security & Government

The stocktake is a snapshot of the systems in an agency's estate it can't fully control. The Direction has legacy IT in mind. I’d argue AI-dependent systems, being added faster than agencies can retire the old, are a second class – and will soon be the most important of the pair.

On a frontier-model stack, the weights sit on another company’s servers. Inference runs where that company decides. Training data was selected offshore. Governance over what the system will (or won’t) do is written there, too. On 30 days’ notice, deprecated models, Terms of Service updates, content policy changes, or quiet adjustments to prompt behaviour can change what the system does. Or stop it entirely.

These are the same characteristics that make legacy IT a risk, with the same mechanic on a different lifecycle. And the stocktake, as it’s currently scoped, has nothing to say about it.

The AI-dependency column

The fix sits inside the stocktake itself. Add an AI-dependency column to your PSPF register, next to the legacy-technology column the Direction already asks for. For each system in the estate, note where it depends on a vendor-controlled AI model, which vendor, and what breaks if that dependency changes.

Scope the column widely. For example: Microsoft Copilot across the M365 estate, custom RAG apps on top of frontier model APIs, MCP connectors routing to hosted inference, and agent frameworks assuming a specific model's behaviour.

If the vendor made a change next week, would something in the agency's workflow stop working the way it does today? If yes, it goes on the register.

What the column needs to carry:

• The system and the vendor it depends on
• The dependency type: inference, fine-tuned weights, agent runtime, orchestration
• The switch cost if the vendor changes behaviour
• The residual-risk acceptance, if any

This table is an illustrative example only

The register runs on a schedule. Monthly on the AI-dependency column while the vendor landscape stays this volatile, quarterly once it settles. Any vendor-side move triggers an interim review.

Audits, board papers, incident response and procurement decisions all run off the same inventory. The agency walks into those conversations with a current answer to "what are we exposed to and where."

The posture

"A mature cyber function aims for one outcome: being unsurprised when the world tilts.”

Peter Soulsby, Director of Cyber Security & Government

The PSPF stocktake, extended with the AI-dependency column, buys that outcome. The register tells the agency what it has. The triage deals with what it can modernise this cycle. Everything else gets a pre-settled response for the day something changes.

That's the shape of a mature agency response to PSPF 002-2026.

Count what you don't control. Fix what you do. Playbook the rest.

My CyberCon argument stands; cyber practitioners should lean in on AI. What makes that responsible is keeping a record of what we depend on and a plan for the day it changes. By March, every federal cyber team should have one.