AUSTRAC watches the money moving through the Australian financial system; Services Australia pays Medicare, child support and aged care. Both run on systems a cyber attack could stop, and the government says its own entities should be cyber exemplars. In the year to June 2023 about 31 per cent of the incidents reported to Australia's signals directorate came from federal entities. This audit, tabled in June 2024, asked how the two would cope when one reached them. Both keep backups; neither had tested restoring them. From there: a recovery schedule that left out Medicare until a financial audit noticed, alerts passed on verbally, seventeen months of archived security data that could not be produced, and a data breach nobody reviewed afterwards. two entities examined - the financial intelligence agency and the government's main service delivery agency; 19 recommendations, all agreed about 31 per cent of the cyber security incidents reported to the signals directorate in 2022-23 came from non-corporate Commonwealth entities 25 per cent of those entities self-assessed at Maturity Level Two across the eight prioritised mitigation strategies; 82 per cent reported holding an incident response plan the whole-of-government protective security policy framework, which carries the mandatory requirements for managing cyber security incidents the signals directorate's cyber security guidelines and its eight prioritised mitigation strategies the public governance statute under which entities must apply that framework, and the audit statute the report is made under the backup, logging and event-management solutions in place, and the assurance actually obtained from them monitoring resources set against spending on preventive controls data centres and backup media, and the protection measures documented for them timeframes for triage, escalation and reporting to stakeholders centralised against decentralised event logging retrieval of production and archived security event data readiness to maintain business continuity after a significant or reportable incident testing of backup restoration and disaster recovery use made of post-incident learning completeness of the critical asset and data registers The audit's overall conclusion turns on this one point: 'Neither entity is well placed to ensure business continuity or disaster recovery in the event of a significant or reportable cyber security incident' (p.9). Both run backups. Neither had established that they come back. At the first entity, 'AUSTRAC performs recovery of backups as part of business area requests. It does not perform testing of restoration of backups for disaster recovery purposes. It does not have a process for extracting and analysing production and archive backup data', and it 'has not tested the recoverability of its systems and applications supporting critical business processes' (p.50). At the second, the plans 'do not include all systems and applications supporting critical business processes and it does not test the recoverability of backups' (p.9), and the gap reaches the paperwork as well: 'Services Australia does not have a policy for managing regular backups', whose recovery documentation omits backup solutions from both the security policies and the disaster recovery testing schedule (p.84). A backup that has never been restored is a belief, not a control. A recovery plan can only cover what someone has listed. 'The Business Continuity Plan outlines the recovery time objectives and maximum tolerable periods of disruption for a list of business processes. Services Australia does not have business continuity or disaster recovery plans that address all systems, including the systems which support the critical recovery processes. Services Australia does not have a complete list of critical assets. As such, Services Australia is not well placed to ensure business continuity or disaster recovery in the event of a significant or reportable cyber security incident' (p.84). What was missing was not marginal: 'Services Australia has a Disaster Recovery Testing Schedule dated 31 October 2023. This schedule did not include all the systems within Services Australia. This schedule was later updated by Services Australia to include three significant financial systems, Medicare, Payment Assessment Calculation Engine (PACE) and Child Support IT system (Cuba). This schedule update was the result of issues identified during the audit of Services Australia's 2023-24 financial statements' (p.84). The national health insurance scheme entered the recovery schedule because a different audit noticed it was absent. The entity's own plan sets the standard: its incident response plan 'states that "all information must be saved for future analysis preferably to a location not itself susceptible to [a security] incident"' (p.49). Practice stopped short of it. 'Only significant SIEM investigations are reported and logged in AUSTRAC's record-keeping repository where "significant" is defined by the security analyst. The SIEM investigation records include event logs, minutes and communications. Security alerts that have not been determined as "significant" are only reported verbally' (p.49). What was kept could not always be fetched back either: 'AUSTRAC could not provide archived SIEM data from 1 June 2022 to 31 October 2023. AUSTRAC does not have processes for extracting and retrieving cyber security events from either the production environment or archives for future analysis' (p.49). Seventeen months of the record, and the judgement of which events enter the record at all, rest on one analyst and on memory. Detection was built on an arrangement nobody designed. 'The decentralised event logging approach was a result of historical management arrangements, where IT environments were managed by different AUSTRAC business areas and it has not been implemented in the recommended way. A centralised logging approach offers better control, efficiency and standardisation as recommended by the ASD's Guidelines for System Monitoring' (p.48). The reason given for leaving it there is the finding worth carrying: 'AUSTRAC has not implemented ASD's recommendation for appropriate SIEM coverage or documented a strategy for prioritising its event monitoring resources due to a "focus on implementing preventative controls to mitigate cyber security incidents"' (p.48). The summary states the consequence plainly - the 'coverage of event logs is not in accordance with ASD's Cyber Security Guidelines' and the entity 'does not have an event logging policy' (p.9). Spending on keeping attacks out is not a substitute for being able to see one that gets in. Both entities have the steps written down and neither has said how fast they must happen. For the first: it 'does not document cyber security incident meetings, nor has it defined timeframes for reporting to relevant stakeholders' (p.10), and it 'has not defined timeframes for analysing cyber security events, nor does it perform any analysis on the timeliness or completeness of triaging and escalation processes' (p.49). For the second: it 'has not established a timeframe for triage and escalation activities nor a process for analysing archived SIEM data' and 'has not defined an approach for cyber security investigations' (pp.9-10), and it 'has not defined the timeframes for reporting to relevant stakeholders' (p.11). The audit put a recommendation on each of these, and both entities agreed. In incident management the clock is the control: without a defined time to triage, escalate and report, there is nothing to measure performance against and nothing a reviewer can test. The learning is produced and then goes nowhere. At the first entity, 'AUSTRAC's incident reports include post-incident learning and post-remediation analysis. AUSTRAC undertook a root-cause analysis of the cyber security issue in 2023 which identified some systematic improvements. AUSTRAC does not use these incident reports to design and implement a security maturity monitoring plan or update its framework of procedures for cyber security incident management or share learnings internally and externally, where appropriate' (p.56). At the second the omission attaches to a named event: 'Any lessons learned from that experience, including support received from Services Australia's legal function, have not been used to review or update Services Australia's framework of procedures for cyber security incident management. Services Australia has not undertaken a post-incident review or a lessons-learned exercise following a large-scale data breach involving HWL Ebsworth Lawyers' (p.86). The audit's own message to every other entity is that post-incident learning 'greatly improves business continuity and recovery prospects' (p.17). Authority was granted and never described. The first entity 'has established management structures and responsibilities for managing cyber security incidents. However, it has not documented the assigned responsibilities for its CISO although the CISO is empowered to make decisions' (p.10), and the audit recommended it develop 'policies that define the responsibilities of the Chief Information Security Officer in accordance with the Protective Security Policy Framework requirements' (p.12). At the second the gap is one level higher: it 'does not have a policy covering the management of cyber security incidents' (p.9), and 'In January 2024, Services Australia advised the ANAO that it would commence developing the Cyber Security Incident Management and Response Policy from March 2024' (p.86) - that is, after the audit had begun. The report draws the general lesson for everyone else: entities should document policies and procedures, 'which is important for managing staff turnover', particularly where an organisation depends critically on a few key security advisors (p.17). A serious incident is a legal event as much as a technical one, and neither response process treats it that way. At the first entity the reporting processes 'do not include the engagement of relevant expertise in other business areas, such as legal advisors, and do not ensure the integrity of evidence supporting cyber security investigations' (p.41). At the second, the programme built to catch the insider threat was assembled without that advice: its 'trusted insider program has not considered input from other business areas, such as its legal function' (p.60), and the same is true of the external reporting process, where the audit found no 'consideration of engaging other relevant expertise, such as legal advisors, during reporting processes' (p.60). The audit raises this to a message for all entities: as the regulatory landscape reforms, an entity should consider how its legal function 'will support their governance committees during the external reporting process to manage increasing scrutiny and liability risks' (p.17). Evidence that will not stand up is evidence collected for nothing.