Senate Finance and Public Administration Legislation Committee [Part 2], , 2:54:41 to 3:05:04
Officials define legacy systems based on ASD guidance and discuss the audit of over 200 systems and sites. The agency provides a status update on implementing recommendations from ANAO cybersecurity performance audits.
Topics: Government IT systems, Integrity, Privacy
Speakers: David Hazlehurst, Claire Roennfeldt, Senator The Hon Jane Hume, Senator The Hon Katy Gallagher, Unknown Speaker
is held. So the medical statistics portal obviously is a legacy system that's been mentioned many times. How many legacy systems do we have currently operational in services Australia?
probably a definitional thing there that we need to deal with cuz legacy sort of and I think I used it in the press conference too so it's partly my fault but there's legacy systems that are operational systems. They're old systems but they're operational. And then there's the idea of uh systems which essentially could be run off [laughter] uh data.gov.auu. So just want to make that distinction in in how people talk about legacy systems.
>> Well, I'd even add um minister senator in common parlance uh legacy can just mean old. >> Yes. Um but there is a distinction between um the kinds of legacy systems that for example uh Stephanie Foster has put out through her directive under the PSPF which has a technical meaning which we're very happy to talk through if that's helpful to the committee. Uh and so we're going through a process of confirming and classifying including through consultation with um home affairs um which ones are in scope um of our very large number of systems well over a thousand systems. Uh some of those of course are just internally facing so there's no public exposure in inverted commas to those. Um so we're trying to work through the precise scope of the ones that um are are within the gambit of the new directive and indeed >> um the direction from the minister for us to uh work out whether there are other things like the Medicare stats site which I'm pleased to say there aren't things like that stats site. Um and indeed as um Mr. Fouch had said that site's been shut down and all the data from that's been transferred to data.gov.
>> So you ordered home affairs though to undertake a stock take of legacy systems. What's the definition that they are using?
>> Uh under ASD guidance technology is considered legacy only where it meets at least one criterion in which two in each of two categories. So the first is that it's end of life or out of vendor support including extended support and second is it's impractical or no longer cost-effective to update or support. It exceeds the entity's acceptable risk threshold or offers diminishing business utility or obstructs delivery of the entity's ICT strategy. And so age alone doesn't make a system legacy. Uh, I'll mention, Senator, that when I came into the role, I was advised the word is heritage for some of Services Australia's systems because they're actually very strong and stable even though they are legacy and have been around a very long time.
>> So, is that Home Affairs definition or is that Services Australia's definition?
>> No, that's ASD's guidance.
>> That's ASD's guidance
>> and that's what Home Affairs is referencing.
>> Right. Okay. So how many legacy systems is home affairs looking at as part of its stock take?
>> Uh it's not we are its directive was to each agency
>> right
>> uh to make those assessments.
>> Okay. So how many are you looking at?
>> Uh sorry about that. Um, Senator, we have over,200 systems, sites, and applications. And given, as we've mentioned, the definition means things, different things. So, we're focused on this definition, but that means that as we work our way through, we need to understand what that looks like within our technology stack uh, and in our estate. And so, um, I don't want to mislead you and give you a number yet because it could be cut in various ways. So, we are working on responding to the home affairs uh sorry the PSPF directive that was given by Stephanie Foster and we are we will have we're on track to provide that response by December and then the follow-up response by March as well. So, I don't want to mislead you because it could be cut in a number of ways. I'm happy to take that on notice though so that I come can come back with a really clear information once we have because we've just started working through this PSP PSPF direction.
>> Okay. I'm sure that this is the sort of information that the minister has been asking for. You know, she would be pretty thorough in dealing with this. So, um I think it would be um not unreasonable to ask for the number of legacy systems according to the ones that Home Affairs have have had the stock take of u or that you have had the stock take from the with the assistance of home affairs. um using the ASD definition and perhaps if there are other definitions of legacy system or heritage system or whatever system it is that you think needs to be looked at if you could specify how many of those
there we'll align it with the that ASD uh definition >> and just to clarify again Senator um we're not so home affairs hasn't identified systems for us the directive gives us uh the requirement to now go through against that definition and look for those systems. So, we've just received that directive not too long ago and we're already undertaking that activity, which is why I was saying uh given this is the direction, I want to make sure that I give you that accurate
information. Okay. Uh look, Services Australia obviously knew that they had cyber security and privacy problems before this open AI breach because the ANAO told them not once but twice. Um there were two reports both of which we've already discussed in some great detail today. Um I want to understand though uh from your perspective um exactly what Services Australia's response has been to those two reports. Um, can I confirm first and foremost that Service Australia were made aware that these reports and their findings that the CEO got a copy of the reports and when they got a copy and uh and the date that they were received?
>> Uh, well, Senator, the of course I was made aware of them um and received copies of them. I think you had a conversation uh with the ANAO that described the process where they will provide us uh with an earlier draft. Yep. >> And then with uh a final version uh for any comments and then the first one was published of course on the 14th of June But in the usual course of events as I said uh I'm happy I don't have the information with me on when those drafts were provided but happy to provide that on notice.
>> Okay. Well, what were the principal risks to the agency that were referenced in the 2024 report?
>> U thanks Senator. So during that 2024 ANAO audit, the NAO found that services Australia's cyber security incident response procedures were largely effective but identified areas requiring improvement and these included cyber incident governance, reporting and escalation time frames, investigation and evidence management procedures, continuous monitoring and recovery assurance and post incident learning. So we agreed to all of the 10 recommendations directed to the agency at the time and we implemented a comprehensive remediation program and all 10 of those recommendations have since been assessed as implemented and closed by the agency's chief audit executive.
>> Were they implemented and closed by the agency's chief audit executive before this breach?
>> Uh Senator, there was a number I could step you through each of the findings um and when they were closed. The last one was closed in September. September
before the breach or after the breach.
>> Um, Senator, I might just need to take that on notice unless I have a colleague who has that information. I could probably come back to you on that shortly just to give you the date of
>> Well, can you tell me for just Okay. So,
Senator, I can add just briefly. Um, eight of the 10 recommendations were closed in, uh, 2025 and two were closed in 2026 and the last one was in September. But we can give you more information on notice if that's helpful.
>> Okay. So, the last ones were closed in September.
>> Last one.
>> The last one.
>> And the breach was in June.
>> We were notified in September.
>> Yeah. It was about incident management this quarter.
Just for the sake of clarity, was the last recommendation implemented in full before you were notified of the breach or after? And did that recommendation have any implications for that breach?
>> Senator, I'm just asking a colleague who we have in the back room to just provide me the date of that September date and then I'll be able to confirm that for
>> you wanted to know why it took two years to complete the recommendations of an audit around cyber security.
>> Uh well Senator as I said um the vast majority of them were completed in 2025. Uh we can provide more information about that specific recommendation. Um I think Mr. Bjou might be able to illuminate us on that. But it I should also add that the process of closure involves doing all of the things and then assuring all of the things. So the doing of all the things had occurred well before the final formal closure. Uh but I might defer to Mr. Brujo who have more information on the date.