Parliamentary Information and Cyber Resilience upgrade has $40m budget

The government’s high-profile Parliamentary Information and Cyber Resilience (PICR) project is proceeding with a budget of $40 million over four years, it can be revealed.

Speaking at senate estimates, the Department of Parliamentary Services chief operating officer and deputy secretary Nicola Hinder revealed the funding figure after it had been excluded from budget papers.

PICR is paying for “necessary enhancements for Parliament’s critical IT systems”, including the Parliamentary Computing Network or PCN that is used by parliamentarians, senators and staff, and connects Parliament House to ministerial and electorate offices around the country.

“When the funding was first provided to the department it was provided on a not-for-publication basis for commercial sensitivities. However, I can advise that we received in the order of $40m over four years,” Hinder said.

She also revealed that the funding is being split between three streams of work, although the precise split is unknown at this stage.

“It’s split into three streams, one of which is in relation to information assurance in government, one is in relation to cyber lift and PCN activities, and the third stream is in looking at our electronic security systems that underpin Australian parliament house,” Hinder said.

As reported by iTnews in June, one of the characteristics of the PCN in its current form is that it is “unsegmented”, which Hinder further contextualised.

Effectively, a single set of “expansive” permissions exist, largely aligned to the needs of parliamentarians.

“The network as it is currently structured has parliamentarians and their staff, [and] it has staff of all of the parliamentary departments operating on it,” she said.

“Because we are in deep appreciation of the work that parliamentarians undertake and the need for them to engage broadly and expansively in a variety of media, the system controls that have been applied to parliamentarians have led towards the environment where a range of activities is permitted – but the accountable authorities of the departments, and the staff that work within those departments, have had those same controls applied to them. 

“One of the first streams around the PICR program is segmentation of the network, so that the DPS secretary has responsibility and accountability for the PCN and the settings that she sets for her staff, and the accountable authorities for the parliamentary departments have got responsibilities and accountabilities for the settings they set for their staff.”

The “multi year uplift program” for the PCN will run until 2029/30, and is “well underway”, Hinder said.

Focus on the PCN was elevated after a malicious attack in early 2019 that forced a mass reset of access credentials.

Central risk management

An audit of how cyber security risk is managed by the Department of Parliamentary Services found it did not have a “a single source of truth for identified risks and issues … relating to essential cyber security strategies”.

The audit “identified instances in which cyber security risks were assigned to system owners for management of the risk, where those staff had subsequently left the department.”

Hinder said this is now being addressed.

“We have established a dedicated cyber governance risk and assurance function within the cyber security branch,” she said.

“That team has done an incredible amount of work already in relation to centralising the risk assessment register that we have on cyber risks. 

“It did not used to be centralised, it was dispersed, which led to this issue, which is that there were risk assessments dispersed through the information services division and possibly elsewhere where responsibility was not being properly moved on when people were moving on, and they weren’t being looked at and reviewed as a whole across the system. 

“So, as a result we’ve established that team, with a centralised risk register.”

As part of its work, Hinder said that the new team had identified “104 historical risk assessments that were marked complete but had no assessment evidence. “

“This is the issue that the [audit office] was raising with us,” Hinder said.

“[The cyber governance risk and assurance function] has now identified that and are in a process of reviewing those historical risk assessments. 

“They’re also working on 33 new risk assessments, they’ve got 18 new cyber assessments in progress, and they’ve also done 61 new cyber risk assessments, so this team is absolutely running to deal with that issue.”

Hinder also said that more broadly, staffing within the cyber security function had stabilised, after a period of high attrition.

“We’ve got a [cyber security] branch that is now fully staffed and has been staffed for close to a 12 month period,” she said.