Senate Finance and Public Administration Legislation Committee, , 3:06:29 to 3:10:29
The committee examines high staff turnover within the cyber security branch and the implementation of a centralized risk assessment register to address historical gaps identified by the ANAO.
Topics: National security, Public service staffing
Speakers: Jaala Hinchcliffe, Hon James McGrath, Nicola Hinder, Unknown Speaker
>> Thank you. U Senator Hume asked a number of questions I had in relation to the ANO report. I might still put some of those on notice just to ensure um haven't missed anything. But I do want to just one part of it is that it that at February 2026 55% of staff in the cyber security branch had been with DPS for less than 12 months. Um why had there been such a significant turnover in the branch responsible for protecting
previous um testimony or evidence that we've given at the committee, we have discussed that there have been a range of senior level departures from DPS in the ICT um area. Uh some of those departures occurred because of matters that had been independently looked at. Some of those departures have occurred because people have chosen to taken up alternate arrangements. Uh we have said that there has been turnover within our cyber security branch. However, I'm very pleased to say that we have got a branch that is now uh fully staffed and has been staffed for close to a 12-month with very deeply technically experienced well- reggarded operators.
>> I should say um I've got a SIM card in my iPad. Um so I don't know what Senator Shoebridge was talking about there. So you can I didn't want to interrupt I didn't want to interrupt him but >> I I think that >> so I think
>> you senator we were trying to be gentle.
>> Yes I think the service you guys provided is brilliant. Um I do want to ask um the ANO found instances where cyber security risks remained assigned to system owners who had subsequently left the department um sort of how was that allowed to happen and what changes have been implemented to ensure security risks are reassigned and properly managed when staff
>> leave. Senator, the first recommendation was that [clears throat] DPS review its governance arrangements and risk assessment process and as a result we have established a dedicated cyber governance risk and assurance function within the cyber security branch. This has been um incredibly important to centralize the work that we're doing in relation to risk and assurance in relation to cyber. That team has done um an incredible amount of work already in relation to the um in relation to centralizing the risk assessment register that we have on cyber risks. It did not used to be centralized. it was dispersed um which led to this issue that you have raised and that the ANAO raised which that which is that there were risk assessments um dispersed through the information services um division and possibly elsewhere which um were not being um properly uh properly moved when people were or responsibility weren't being moved on when people were moving on. um and they weren't being um looked at and reviewed as a whole across the system. Um so as a result, as I said, we've established that team. We've centralized the risk register. They are going through a process at the moment of reviewing all of the risks that are in the centralized risk register. They've identified um and I find this um quite shocking. and they identified 104 historical risk assessments that were marked complete but had no assessment evidence. This is the issue that the ANO was raising with us. Um they've now identified that and are in a process of reviewing those um those historical risk assessments. They've now also working on 33 new assess risk assessments. They've got uh 18 new cyber assessments in progress and they've also done in that time 61 new cyber risk assessments. So this team is absolutely running to deal with that issue that the ANO has raised.