Cyber Security NSW is not a regulator. It is a branch of the Department of Customer Service, set up in 2019 by renaming an earlier office, and no Act of Parliament establishes it. Its authority comes from a circular issued by the department's Secretary. It writes the cyber security policy every NSW Government agency must follow, collects the agencies' annual reports against it, and coordinates the response when something goes badly wrong. Through ID Support NSW, which sits inside it, it also helps members of the public whose driver licences and other identity documents have been stolen or exposed.
Its central job is to know whether the systems that hold the public's data are secure, and to make them more secure.
A measure that was not tested
Each year every agency assesses its own cyber security against the policy, and its head signs an attestation. The Auditor-General has described these self-assessments as "the only measure of cyber security maturity of the NSW Government".
In 2021 the Auditor-General tested nine agencies' self-assessments against the evidence. All nine had overstated their maturity on at least one requirement. Of 180 assessments, 24 were not supported by evidence, and in all but one of those the error made the agency look better than it was. Seven of the nine signed the standard attestation, unmodified, saying they had managed cyber risks "in a manner consistent with the Mandatory Requirements". One of the seven had rated itself at level three or above on only 7 of 20 requirements (Audit Office of NSW, Compliance with the NSW Cyber Security Policy, October 2021).
The office had been given a remit to check. A 2020 guideline from the department's Secretary said agencies would be "subject to audits by Cyber Security NSW commencing 2020-21". In February 2023 the Auditor-General reported that the office "has not carried out these audits and does not seek its own assurance of the results" (Audit Office of NSW, Cyber Security NSW: governance, roles, and responsibilities, February 2023).
By then the office had ceased its compliance and assurance programs. "To reduce duplication and burden on entities we ceased our compliance and assurance programs in June 2022," its 2022 Year in Review said, leaving assurance to agencies' own internal auditors. Nine months earlier the Government had told Parliament it had established a function "to oversee agencies' cyber security progress and ensure compliance with the reporting obligations" under the policy. That was its answer to a Legislative Council committee which had asked that the office be given "a clearer mandate" to do so.
The Auditor-General recommended independent assurance over the self-assessments in 2021. The response, in February 2024, was guidance that agencies "may use". In the first year under the new policy, 59% of agencies reported no independent assurance at all.
The target
In 2020, when the office's budget was lifted to $60 million over three years, its business case set an outcome target: raise aggregate NSW Government cyber maturity from 2.7 to at least 3 on a five-point scale within three years. The Auditor-General found "no subsequent plan or roadmap for moving toward the level 3 target".
The three years ended in June 2023. Agencies reported that year on the old scale, so a result could have been calculated. None has been published. In February 2024 the scale was replaced with a compliant, partially compliant or non-compliant rating.
The figures the Auditor-General has published from the agencies' own returns show little movement. From 2019-20 to 2022-23, the median rating for seven of the eight basic controls in the national "Essential Eight" framework never rose above 1 on a scale of 0 to 3. In 2024-25, under the new policy, 33% of agencies were compliant with the requirements in the "Protect" domain, and 11 of 71 were compliant on patching their applications.
None of those consolidated figures was published by Cyber Security NSW. It has never published an overall compliance or maturity result, or an exact count of the incidents agencies report to it. It said in 2021 that it would launch an annual report, and in 2023 that it would report against its performance indicators in 2024. Neither has appeared. Its Years in Review for 2019 to 2022 and for 2024 have been taken off its website.
What has improved
The policy issued in February 2024 required agencies to implement the Essential Eight to at least its first maturity level, and required agency heads to sign off on anything not fully met. Since August 2025 agencies have had to report cyber incidents within 24 hours. The office has no power to order an agency to fix anything; that is how the Government designed it.
ID Support NSW is the part of the office that deals directly with the public. The Minister said it "provided assistance and information to more than 75,000 customers" in 2024-25; the department's annual report for the same year gives a figure of more than 34,000 citizens, and neither number is defined. In August 2025 Parliament passed the Identity Protection and Recovery Act to put its work on a legal footing, including a register of compromised identity documents that was "expected to go live" in 2026.
A person who contacts ID Support has no published standard for how quickly they will be helped, and no result has been published for how quickly anyone has been. Its home page, last updated in May 2026, still says its content "will be updated shortly" to reflect the new Act. The Act gives its powers to the department's Secretary rather than to the office, and contains no reporting requirement of its own.
A member of the public who finds a security flaw in a NSW Government system has no whole-of-government channel to report it. A departmental pilot covers "a limited list of domains" and promises no response time. Queensland promises a reply within three working days and to tell the reporter when the matter has been addressed.
The grade
Regulator Review proposes a grade of D: poor. The office does the visible parts of its job, and it has tightened the rules since 2024. It is not graded higher because the purpose of the job is to know whether NSW Government systems are secure, and on the public record it cannot show that it does. It relies on self-assessments that were overstated when the Auditor-General tested them, it ceased its compliance and assurance programs without carrying out the audits it had the remit for, it has not published a result against its own target, and the consolidated figures on the state of the sector have come from the Auditor-General rather than from the office.
The Auditor-General has listed cyber security for a further performance audit in the Audit Work Plan 2026-2029.