Senate Finance and Public Administration Legislation Committee [Part 2], , 1:19:23 to 1:26:45
Senator Hume questions the ANAO regarding a 2024 performance audit into Services Australia's management of critical cyber security incidents.
Topics: Government IT systems, Online safety
Speakers: Senator The Hon Jane Hume, Dr Caralee McLiesh, Ian Goodwin, Lisa Croswell, Unknown Speaker
>> Thank you chair and thank you Dr. McCleasion and to your team for uh doing what you do. Uh I would like to discuss two reports the NAO conducted relating to no surprises here services Australia and their preparedness for cyber security systems and the handling of data privacy in particular. So they are reports number 38 23 24 and report number 12 of 2526. I want to understand when these audits were completed whether um services Australia whether the services Australia CEO received the findings and the separate detailed technical materials and on what dates that CEO received
>> Right. Uh thank you for the questions. I think the first audit that you referred to was an ANO performance audit that was tabled in June 2024. >> June 24. uh which found that services Australia's management of critical cyber incidents was apparently effective. Um key deficiencies at that time included uh lack of a detailed comprehensive cyber security incident management policy uh lack of clear escalation paths or uh time frames for reporting major infiltrations to bodies like ASD um and also an absence of structured approaches for threat and vulnerability assessments during incidents. Uh at that time, services Australia accepted all 10 recommendations that the NAO made. Um the accountable authority would have received um the report as part of our uh standard process of um sending a proposed report before publication. Uh and as I said that they accepted all uh 10 recommendations. The audit was a point in time uh and we've not audited um implementation but the uh recommendations would appear to have relevance to the uh the uh management of the of the recent um incident in relation to um uh open AI um uh bots accessing accessing the website on the um privacy audit. I will hand to my colleagues to um speak to speak to that.
>> Thank you.
>> Uh yeah thank you. So the report number 12 on the uh data privacy within was tabled on the 9th of December 2025. Um and it would have gone through the normal processes um similar to the other report that the a general outlined. we would issue a section 19 report ahead of time and so that would have been in the last quarter last quarter of calendar 2025.
>> Right. Okay. What's a section 19 report?
>> Section 19 report is is when we um finalize our work on a performance audit. >> It just refers to an aspect under the act where we give the report for 28 days. Right. >> Um it's part of the due process to the audit entity.
>> I understand. Can I ask that in relation to that 2024 report, did it include internetfacing legacy systems, externally accessible services or weaknesses in vulnerability testing?
One moment and get the right person to
Uh Lisa Croswell, group executive director. um the 2024 report um we didn't do a detailed technical assessment of front-facing controls. We were looking for um services Australia and the way that they would um potentially manage a response to a cyber incident. So um a lot of our cyber reports do go to technical testing of detailed technical controls. This particular report went to their processes and um the controls that they have in place for dealing with um and managing and identifying uh and responding to a cyber incident.
>> Right. So, uh, the Medicare statistics reporting portal that was the subject of the breach recently, um, was that portal or the technology that was supporting it, was it named or was it described or was it covered in any schedule or any asset listing or risk register or test briefing that was provided by ANAO? >> Uh, not not specifically. >> Not specifically. >> Right. As part of your reports then has services Australia considered transferring its held data to an existing secure platform or decommissioning legacy systems or portals. Was that one of the recommendations or responses?
>> Uh no. So the the recommend the recommendations went to um services Australia improving their processes and documentations for responding to incidents. we didn't specific specifically make mention of uh technological platforms or or how they handled such things.
>> Okay. So, services Australia responded to both that report and the later report that was described by Mr. Goodwin there um saying it would undertake work to address the recommendations. So, in relation to that 2024 report, have you did then do an assessment as to whether the recommendations have been
implemented? Uh so we have not gone and done a follow-up audit on that particular report.
when you did the 2025 report and I know they're on different things. Did you see any evidence in the 2025 report that the responses that that Services Australia had responded to the 2024 report or are they such different reports on different things that you wouldn't do that?
>> They they do cover they the reports are different reports. Mhm. >> Um so the the one in 2025 was looking at um whether services Australia had appropriate arrangements to manage the privacy of client information um having regard to um the privacy framework. Um and it its finding was that service Australia was partly effective in managing the privacy of client information.
>> Right. Okay. So the the recommendations in the 2024 report, should there have been sufficient time between the time of the report and the recommendations and now to have implemented all of the recommendations?
>> Most of uh most of the recommendations that we make are implemented within a 24-month time period. And um I think there there is nothing that would stand out in the 10 recommendations that we made to services Australia that would take uh longer longer than that. Um we don't t we don't we don't follow up on the implementation of of recommendations directly unless I choose to conduct an audit of that >> but um services Australia's audit committee would track implementation of recommendations and so they should be able to uh provide information on the status of implementation.