The state’s cyber security office in New South Wales, Cyber Security NSW, has failed to carry out any audits of the state agencies’ self-assessed cyber security maturity to date.
The agencies are expected to self-assess their cyber security posture and report their results to Cyber Security NSW, which was meant to begin auditing the assessments in 2020-2021.
The auditor-general stated that without the audits, Cyber Security NSW is not providing the level of assurance that the agencies’ self-assessments are consistent and sound.
Previous findings by the auditor-General showed that agencies have a tendency to over-assess their cyber security maturity and some lack evidence to support their assessments.
An external audit commissioned by Cyber Security NSW found that there were varying approaches in how agencies performed their assessments, but no action was taken to rectify the inconsistencies. The auditor-General concluded that Cyber Security NSW needs to take a more active role in auditing the agencies’ self-assessments to ensure accuracy and compliance.
