NSW government at serious cyber security risk: Auditor-General

The state government is ill-prepared for cyber attacks with four-in-10 government agencies having a low capability to detect data breaches, an investigation by the Auditor-General found on Friday.

“The NSW public sector’s ability to detect and respond to incidents needs to improve significantly and quickly,” the Auditor-General, Margaret Crawford, found after an extensive review of the government’s preparedness. “There is a risk that incidents will go undetected longer than they should, and opportunities to contain and restrict the damage may be lost.”

Despite appointing the first government chief information security officer last year, the Auditor-General found major gaps in the way NSW public sector organisations manage breaches.

Of the 10 agencies that had their capabilities for detecting breaches examined, only two had a “very high” capability for detection.

Four had “low” or “very low” capabilities for detecting when their computer systems had been compromised.

Only one in 10 demonstrated they met federal standards for reporting suspected cyber security incidents or the minimum expected training for computer users and system administrators.