Appendix C: Scope of this review
Download a PDF copy of Appendix C: Scope of this review.
Appendix B: Abbreviations, acronyms and glossary
Download a PDF copy of Appendix B: Acronyms, abbreviations and glossary.
Appendix A: Submissions and comments
Download a PDF copy of Appendix A: Submissions and comments.
2. How our recommendations seek to improve public services
Our recommendations suggest what agencies should improve and the type of action required to make these improvements.
We categorised our recommendations using the COSO framework to help us understand what and how agencies should improve.
We also grouped our recommendations into themes to understand what we commonly recommend agencies should improve.
1. How agencies responded to our recommendations
We consulted with the audited agencies and considered their views when reaching our conclusions. The agencies’ responses are in Appendix A.
Performance engagements and recommendations
We conduct performance engagements that assess whether public sector agencies have efficient, effective, economical and compliant programs and services.
Appendix C: Audit scope and method
Download a PDF copy of Appendix C: Audit scope and method.
Appendix B: Abbreviations, acronyms and glossary
Download a PDF copy of Appendix B: Abbreviations, acronyms and glossary.
Appendix A: Submissions and comments
Download a PDF copy of Appendix A: Submissions and comments.
3. Whole-of-government approach to cybersecurity
The public sector does not use its size and economy of scale to address cybersecurity risks in a coordinated way. Agencies have recognised the need to establish a whole of government approach but need to do more to improve the public sector’s cybersecurity.
2. Effectiveness of identity and device controls
Agencies are not adequately prepared to prevent cyber attacks. This is because they have not correctly configured all of their Microsoft 365 cloud-based identity and device controls.
Why identity and device controls are important
Identity and device controls are 2 pillars of the zero trust model. These controls help an agency: