All agencies can improve the technical security controls applied to their known servers.
Based on our assessment against established industry benchmarks, the maturity level of technical security controls applied by all agencies to their known servers is low.
Most known servers are running operating systems that are not receiving mainstream support.
These factors increase the risk that agencies will not detect server vulnerabilities.
No audited agency has a complete and accurate server inventory.
Automated asset discovery tools used by agencies do not capture all servers, and few agencies use reconciliations to crosscheck their server inventory. All agencies provided us with server inventory information that had either incomplete or duplicate entries.
If agencies are not accurately tracking all their servers, they do not have all the information they need to protect their IT infrastructure.
Covered in this section:
We made 3 recommendations to address our findings. The relevant agencies have accepted the recommendations in full or in principle.
| Recommendation | Agency response(s) | |||
|---|---|---|---|---|
| Finding: No agency has a complete and accurate server inventory | ||||
All agencies
| ||||
Our audit followed 2 lines of enquiry:
1. Do agencies track all their servers and apply foundational security controls to them?
2. Do agencies monitor their server security and strengthen it in response to threats?
To answer these questions, we examined:
Download a PDF copy of Appendix C: Audit scope and method.
Download a PDF copy of Appendix B: Abbreviations, acronyms and glossary.
Download a PDF copy of Appendix A: Submissions and comments.
On average, DTP and ERV took 214 days to process claims from regional councils and 118 days to process certified estimates from regional councils.
Claims spent the most time waiting for assessments to start and waiting for missing information.
Processing times decreased substantially as DTP increased its assessor pool and improved its processes.
Covered in this section:
As of April 2025, ERV has approved $77.9 million in claims and $66.4 million in certified estimates from regional councils for the October 2022 floods under the national DRFA.
Councils received $73.7 million in early financial assistance from the Natural Disaster Relief Trust Account, with first payments issued in January 2023.
The Treasurer approved $823.5 million in Victorian Government department requests for Treasurer's Advances for flood relief and recovery within 2 weeks of submission. Departments had spent this funding within 8 months.
The Resource Management Framework helps departments apply the policies, processes and legislative requirements around using public funds. But DTF did not ensure compliance with all the Framework requirements for urgent and unforeseen claims.