Senate Finance and Public Administration Legislation Committee (part 3 of 3)
26 October 2026
Speaker dots
- Speakers in the chapter
- Colour: political group
- Grey: no group
Tap or click a chapter's dots to see names and groups.
Contents updated on 26 Oct 2026
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
Official source
Offset
Transcript offset
0s
Text size
Export
Live capture
Versions of this video
Transcripts may differ slightly from one version to another.
Senate Finance and Public Administration Legislation Committee Australian Parliament
00:00 - 00:41
Speaker 2
Thank you, Chair, and thank you, Dr. McPhee, and to your team for doing what you do. I would like to discuss two reports the ANAO conducted relating to, no surprises here, Services Australia and their preparedness for cybersecurity systems and the handling of data privacy in particular. So they are reports number 38, 23-24, and report number 12 of 25-26. I want to understand when these audits were completed, whether Services Australia, whether the Services Australia CEO received the findings and the separate detailed technical materials, and on what dates the CEO received them.
00:41 - 02:03
Speaker 3
Right, thank you for the questions. I think the first audit that you referred to was an ANAO performance audit that was tabled in June 2024, which found that Services Australia's management of critical cyber incidents was partly effective. Key deficiencies at that time included a lack of a detailed comprehensive cyber security incident management policy, a lack of clear escalation paths or timeframes for reporting major infiltrations to bodies like ASD, and also an absence of structured approaches for threat and vulnerability assessments during incidents. At that time, Services Australia accepted all 10 recommendations that the ANAO made.
The accountable authority would have received the report as part of our standard process of sending a proposed report before publication, and as I said, they accepted all 10 recommendations. The audit was a point in time, and we've not audited implementation, but the recommendations would appear to have relevance to the management of the recent incident in relation to OpenAI bots accessing the website. On the privacy audit, I will hand to my colleagues to speak to that.
02:03 - 02:06
Speaker 4
Thank you. Yeah, thank you.
The rest of the transcript is for Pro customers
Unlock the full transcript, chat, and every analysis feature with Polyfact Pro.
Start a free trialAsk anything about this video — I analyse its transcript to answer.