According to an audit, federal government entities that use outsourced IT providers are not evaluated on how well they adhere to expected cyber security requirements when providing services.
The audit involving three organisations, including the Department of Foreign Affairs and Trade (DFAT), the Australian Federal Police (AFP), and the Australian Taxation Office (ATO), was released late on Wednesday.
The extent to which these contracts — and the subsequent period of contract management — verified compliance with the Protective Security Policy Framework (PSPF) requirements on agencies, as well as the ACSC’s Information Security Manual (ISM) and the agencies’ own security policies, was examined in relation to three outsourced IT arrangements, one at each agency.
The auditor discovered that “all chosen contracts required contractual providers to abide by the PSPF, ISM, and entity internal policy standards.”
In order to manage non-compliance with PSPF, ISM, and entity internal policy requirements, none of the entities (the agencies) had processes, performance measures, or service level agreements in place.
Furthermore, none of the companies had procedures in place to check the accuracy of performance data relating to cyber security that was supplied by contracted providers.
Hehir believed that in order for performance to be continuously checked, outsourcing contracts should include particular metrics on security compliance.
The Auditor-General advised that “the specification of significant security aspects should be recorded in the contract and service level agreements.”
This guarantees the validity and enforceability of the security considerations.
The three agencies mostly concurred to alter how security criteria are determined and expressed in contracts for outsourced IT.
