The Report

At a glance

Item	Finding
Body	Cyber Security NSW, a branch of the Digital.NSW division of the NSW Department of Customer Service (DCS). It includes ID Support NSW
Type	Not a regulator. A central cyber security unit inside a department. It writes the NSW Cyber Security Policy that applies to NSW Government agencies, collects their annual self-assessments, coordinates the response to major incidents, and, through ID Support NSW, helps members of the public whose identity documents have been compromised. It cannot direct an agency to fix anything. It is in scope because it holds the oversight and standards-setting role for cyber security across NSW Government
Office holder	Marie Patane, NSW Chief Cyber Security Officer (2026-2028 NSW Government Cyber Security Strategy, p 3)
Enabling law	None establishes it. Its authority is a circular issued by the Secretary of DCS, currently DCS-2021-02, which issues the NSW Cyber Security Policy. The Privacy and Personal Information Protection Act 1998 names it (ss 59ZF, 59ZG) without conferring any function. The Identity Protection and Recovery Act 2025 confers identity protection functions on the Secretary of DCS, which ID Support NSW carries out
Created	20 May 2019, by renaming the Office of the Government Chief Information Security Officer (2017)
Record examined	NSW Cyber Security Policy editions 2019 to 2026-27; circulars DFSI-2019-02, DCS-2020-02, DCS-2020-05, DCS-2021-02 and directive DCS-2025-04; Years in Review 2019 to 2024; Strategic Plan (November 2023); Service Catalogue; 2026-2028 Strategy; DCS annual reports 2019-20 to 2024-25; every Audit Office of NSW report on cyber security 2017 to 2026; Legislative Council Portfolio Committee No. 1 Report 52 (2021) and the Government response; the Identity Protection and Recovery Act 2025; ministerial releases on ID Support NSW; ID Support NSW and Digital.NSW web pages (read 11 October 2026)
Money and staff	About $5 million a year and about 25 staff before 2020; $60m over 2020-21 to 2022-23 for the office within a $240m programme (CSNSW audit p 6 / p 1, p 11 / p 6); 87 staff in 2021 (Year in Review 2021); 76 ongoing positions filled, 5 contractors and 22 vacancies in March 2022 (CSNSW audit p 12 / p 7); job losses proposed in September 2024 (press). ID Support NSW: "a four-year, $22.7 million funding commitment through the 2024-25 Budget" (ministerial release, 7 May 2025)
Proposed overall grade	D
Short reason	Its one measure of whether NSW Government is getting safer is agencies' own self-assessment. When the Auditor-General tested nine agencies in 2021, all nine had overstated their position. The office had a remit from 2020-21 to audit the self-assessments; in February 2023 the Auditor-General found it had not carried out those audits, and it had ceased its compliance and assurance programs in June 2022. Its 2020 business case set a numeric maturity target; no result against it has been published, and the scale it was expressed in was replaced in February 2024. It has never published a consolidated compliance or maturity figure. Against that, the 2024 policy made the Essential Eight at Maturity Level One mandatory, a 24-hour incident reporting rule took effect in August 2025, and ID Support NSW gives the public a service that the law now recognises

The grade follows the six criteria settled for Regulator Review on 11 October 2026. Section 11 sets out each criterion, its grade and the reasoning.

This report builds on the working paper "Cyber Security NSW, measured by its own numbers" (19 September 2026) and its extracts, which were checked against the sources (228 items) at the time. It adds the Identity Protection and Recovery Act 2025, the statutory position checked on the NSW legislation website, and ID Support NSW.

Citation shorthand: "CSNSW audit" is the Audit Office performance audit "Cyber Security NSW: governance, roles, and responsibilities" (8 February 2023). "CSP compliance report" is the special report "Compliance with the NSW Cyber Security Policy" (28 October 2021). "IC&G" is the annual Internal controls and governance report. Audit Office pages are given as PDF page / printed page.

1. What the body is for

1.1 What the law says

No Act establishes Cyber Security NSW or states its functions. A search of in-force NSW legislation for the phrase "Cyber Security NSW" on 11 October 2026 returned one Act, the Privacy and Personal Information Protection Act 1998. Sections 59ZF and 59ZG, inserted in 2022 as part of the mandatory notification of data breach scheme, exempt the Information and Privacy Commission and Cyber Security NSW from some information protection principles when they exchange information, including information disclosed "to enable Cyber Security NSW to exercise its functions" (s 59ZF(2)). The Act does not say what those functions are.

The Auditor-General describes the office's authority as "a mandatory administrative requirements circular issued by the Secretary of the Department of Customer Service" (CSNSW audit p 9 / p 4). A circular can be amended or withdrawn by the Secretary who issued it, without Parliament.

The Identity Protection and Recovery Act 2025 (No 45, assented and commenced 15 August 2025) is the first Act to give any part of the office's work a statutory footing. It does so indirectly:

• Its objects are to enable "the Secretary" to carry out and facilitate the protection and recovery of personal information from personal data compromises, to facilitate remediation, to protect organisations, and to "adopt and recommend best practice standards" (s 3).
• "Secretary means the Secretary of the Department", and "Department means the Department of Customer Service" (Sch 4).
• The functions are the Secretary's (ss 9-11), exercisable only on request or in specified circumstances (s 12), and may be delegated "to a member of staff of the Department" (s 17). The Act does not mention ID Support NSW or Cyber Security NSW.
• The Secretary "must keep" a compromised ID register (s 18), must tell an individual "as soon as reasonably practicable" when their identity document is recorded on it (s 22(1)), and must tell the issuer of the document (s 23).
• The Secretary may charge fees (s 16). An Identity Protection and Recovery Fund is administered by the Secretary (s 34).
• The Minister must review the Act "as soon as practicable after the period of 2 years from the commencement" (s 39). The Act itself contains no reporting requirement.

(Identity Protection and Recovery Act 2025, legislation.nsw.gov.au, read 11 October 2026.)

1.2 What the office says it is for

On its own page: "Cyber Security NSW leads, implements and supports cyber security initiatives to achieve the vision of a cyber-secure NSW Government". It "delivers products, services and best practice advice and guidance to NSW Government departments and agencies", "coordinates whole-of-government cyber security strategies and initiatives" and "leads the NSW Government response to significant cyber incidents and cyber crises" (digital.nsw.gov.au, Cyber Security NSW, captured 11 September 2026).

The 2026-2028 Strategy adds ID Support NSW: "Through ID Support NSW, we provide targeted support to individuals, public sector agencies and organisations affected by data compromises, helping NSW residents and businesses build identity resilience, and recover from identity theft, data breaches or scams" (section 4).

The current policy lists the NSW Chief Cyber Security Officer's responsibilities as reporting on consolidated agency compliance, maturity and systemic risk; recommending and recording exemptions; receiving, analysing and reporting on high cyber risks and monitoring incident reporting; and coordinating the NSW Government response to major cyber incidents and cyber emergencies (NSW Cyber Security Policy 2026-27, p 10).

1.3 Who it serves

NSW Government departments and agencies, which own their own systems and their own cyber risk; the Secretaries Board and Cabinet, to which it reports; and, through ID Support NSW, members of the public whose identity documents have been stolen or misused. Councils are outside the policy; over them the office has, in the Auditor-General's words, "some responsibility, although no authority" (CSNSW audit p 10 / p 5).

1.4 Who holds it to account

There is no Act constituting the office, so there is no statutory review of it and no annual report of its own to Parliament. It reports inside DCS, and its Minister can be questioned about it at budget estimates. The Auditor-General is the only external body that has audited it and published figures; the February 2023 performance audit is the only external audit of the office itself. The Legislative Council examined it once, in the 2020-21 inquiry into cyber security that followed the Service NSW breach (Portfolio Committee No. 1, Report 52, March 2021).

The absence of a statute is a choice of government, not of the office. It is noted here because it shapes everything that follows, and it is not held against the office in the grading.

2. The test

The core test is the gap between what the body is meant to do and what the record shows it does. For a central cyber unit in a devolved model, that has three parts:

1. Does it know the state of the sector? In a self-assessment model, that means knowing whether the self-assessments are true.
2. Does it act on what it knows: set a standard, measure against it, and make something follow from a gap?
3. Does it answer for its own performance to someone who can see the numbers?

A fourth question applies to the part of the office that serves the public directly, ID Support NSW: what does a person get, and how would anyone know?

3. Does it know? The self-assessment problem

Each NSW agency assesses itself against the Cyber Security Policy each year and its head signs an attestation. The Auditor-General: "These self-assessments provide the only measure of cyber security maturity of the NSW Government" (CSNSW audit p 30 / p 25).

3.1 When tested in 2021, they were overstated

The CSP compliance report tested nine agencies against the 20 mandatory requirements then in force:

• All nine had overstated their maturity on at least one requirement.
• 24 of 180 assessments were not supported by the evidence, and "for all except one requirement the inaccuracy overstated the level of implementation".
• Seven of the nine could not produce evidence for their Essential 8 ratings.
• Seven of the nine signed the unmodified pro forma attestation stating they had "managed cyber security risks in a manner consistent with the Mandatory Requirements". One of the seven had self-assessed only 7 of the 20 requirements at level three or above, the lowest of the nine.

(CSP compliance report pp 10 / 9, 26 / 25, 27 / 26, 31 / 30.)

A later sample, for 2024-25, found that four of nine agencies that kept evidence could not produce full evidence for their assessment (IC&G 2026 p 41 / p 38).

3.2 The audits the office was to carry out

A mandatory guideline issued by the Secretary of DCS in 2020 said agencies would be "subject to audits by Cyber Security NSW commencing 2020-21 to test compliance with the Policy and reporting these outcomes to the Secretaries' Board" (quoted at CSNSW audit p 9 / p 4). In its October 2021 response to the Auditor-General, DCS said a Maturity Assurance Review program was commencing. In IC&G 2022 the Auditor-General recorded that the office was "still in the process of reviewing the self-assessments" (p 39 / p 37).

In February 2023 the Auditor-General found: "Cyber Security NSW has a remit to carry out audits of agencies' self-assessments, but it has not carried out these audits and does not seek its own assurance of the results of these self-assessments" (CSNSW audit p 7 / p 2). This was "despite the Audit Office of NSW (and an external consultant engaged by Cyber Security NSW) previously finding inconsistency in how agencies perform and report these self-assessments" (p 9 / p 4).

3.3 The compliance and assurance programs were ceased

In its 2022 Year in Review the office wrote: "After review and analysis, Cyber Security NSW determined it is most effective for compliance and assurance to be undertaken by the internal audit teams of NSW Government departments and agencies … To reduce duplication and burden on entities we ceased our compliance and assurance programs in June 2022."

On 27 September 2021 the Government had told Parliament that a Governance, Risk and Compliance function had been "established to oversee agencies' cyber security progress and ensure compliance with the reporting obligations under the NSW Cyber Security Policy". That was its answer to the Legislative Council's recommendation that the office be given "a clearer mandate to oversee agencies' cyber security progress and ensure their compliance with the NSW Cyber Security Policy" (Report 52, recommendation 1, pp 11-12; Government response, 27 September 2021). The compliance and assurance programs were ceased about nine months after that response.

3.4 Assurance was recommended, accepted, and delivered as an option

The Auditor-General recommended in October 2021 that the office obtain "objective assurance over the accuracy of self-assessments". DCS accepted a materially identical recommendation in February 2023 and said an assurance methodology would come with the 1 July 2023 policy release. The policy arrived on 19 February 2024. In IC&G 2024 the Auditor-General recorded that the recommendation "remains unaddressed" (p 48 / p 44). What arrived was "assurance guidance in its CSP, which agencies may use to support their attestation and data return". In the first year of returns under the new policy, 59% of agencies reported no independent assurance, 20% had independent assurance and 21% used internal audit (Cyber security insights 2025 p 14 / p 10).

3.5 And the reporting unit got larger

From 2024 agencies could report at portfolio level. Returns went from 110, 112 and 110 in the three years to 2023 to 66 reports covering 177 agencies in 2024 and 71 covering 189 in 2025 (Cyber security insights 2025 p 13 / p 9; IC&G 2026 p 40 / p 37). The Auditor-General: "Aggregated reporting to Cyber Security NSW reduces transparency of issues at individual agencies" (Cyber security insights 2025 p 6 / p 2).

Regulator Review's assessment: self-assessment is the normal instrument in every Australian jurisdiction, and the Auditor-General says auditing every agency would be "neither reasonable nor feasible" (CSNSW audit p 31 / p 26). The finding is narrower. The office held an express audit remit from 2020-21, had two separate reviews telling it the returns were inconsistent, and ceased its compliance and assurance programs in June 2022 without, on the Auditor-General's finding, having carried out the audits the guideline provided for. Independent assurance, recommended in 2021, arrived in 2024 as guidance agencies may choose to use.

4. Does it act?

4.1 The standard

The 2019 reporting template said: "A Mandatory Requirement is considered met if a maturity level of three is achieved." The 2020 template said: "There is no mandated maturity level for either the Mandatory Requirement reporting or Essential 8 reporting." DCS told the Auditor-General its own earlier templates and policy documents "were incorrect" (CSP compliance report p 15 / p 14). The Auditor-General found the policy let agencies determine their own maturity level, "which can include not practicing a policy requirement or implementing a policy requirement on an ad hoc basis. These determinations do not need to be justified" (p 8 / p 7).

The February 2024 policy changed that. It required that "Agencies must implement the Essential Eight … with a minimum requirement of Level 1 maturity" (NSW Cyber Security Policy 2023-2024, section 4), and required agency heads to sign off on anything not fully met. Directive DCS-2025-04, from 4 August 2025, required agencies to report all cyber incidents within 24 hours and to keep asset inventories and third-party registers. It has since been replaced by DCS-2026-03, and the 24-hour requirement is carried in the 2026-27 policy.

4.2 The results, on the agencies' own numbers

• 2020: 5 of 104 agencies self-assessed every mandatory requirement at level three or above (CSP compliance report p 6 / p 5).
• 2019-20 to 2022-23: on the Auditor-General's chart, the median reported maturity for seven of the eight Essential Eight controls was 0 or 1 in every year; only daily backups reached 2. "The median reported maturity shows no improvement in agencies' implementation of the Essential Eight controls since the introduction of the reporting requirement" (IC&G 2023 p 43 / p 39).
• 2022-23: "eighty-five per cent of maturity assessments have not reached level one maturity across each of the Essential Eight" and 94% had not reached level two (IC&G 2023 p 45 / p 41).
• 2023-24, under the new policy: 31% of the mandatory requirements in the Protect domain met across the 66 reporting agencies (Cyber security insights 2025 p 11 / p 7).
• 2024-25: 33% of agencies compliant in the Protect domain; 11 of 71 agencies compliant on patching applications; 7 compliant on asset inventory. "The data for 2025 shows that mandatory requirements are not fully implemented in most cases" (IC&G 2026 pp 37-40 / pp 34-37).

The two years under the new policy are described by the Auditor-General in different units (share of requirements met; share of agencies compliant), so 31% and 33% are not a trend. DCS declared the first year "a transition period" that "will serve as a baseline only" (DCS-2021-02, February 2024 revision).

All of these consolidated figures come from the Auditor-General. None was published by the office.

4.3 The target

The office's 2020 business case, which informed the August 2020 funding decision, set an outcome KPI: lift aggregate NSW public sector cyber maturity from 2.7 to "at least" level 3 within three years. The Auditor-General: "We found no subsequent plan or roadmap for moving toward the level 3 target, nor any benefits realisation plan" (CSNSW audit p 21 / p 16). It is the only numeric outcome target found in the record examined.

The funding period ended on 30 June 2023. Agencies reported 2022-23 on the old maturity scale (IC&G 2023 p 37 / p 33), so a result for the deadline year could have been calculated. None has been published. In February 2024 the five-point scale was replaced by a compliant, partially compliant or non-compliant assessment. Neither the November 2023 Strategic Plan nor the 2026-2028 Strategy restates the target.

4.4 Powers

The office has no power to direct an agency to fix a vulnerability, and no power over councils. The strongest consequence in the current policy is that non-compliance "may result in increased audit scrutiny" (NSW Cyber Security Policy 2026-27, p 2). The Auditor-General: "Cyber Security NSW has limited mandate to directly intervene where risks emerge" (CSNSW audit p 9 / p 4). This is a feature of the arrangements the government chose and is not held against the office. The audit remit in section 3.2 was within its control.

4.5 Recommendations

Central Agencies 2019 recommended: "We recommend Cyber Security NSW works with agencies to improve cyber security resilience as a matter of urgency" (p 33 / p 29). The Auditor-General carried the same point, in changing words, through Central Agencies 2020, Customer Service 2021, the October 2021 special report and IC&G 2021 to 2023, with the recommendation later addressed to agencies rather than the centre. It was not recorded as met in any of those reports. Of the seven headline recommendations of the 2018 audit, which the office was established "partly in response to", the Auditor-General's assessment in February 2023 was that "all have been progressed, with one having been substantially completed" (CSNSW audit p 16 / p 11).

Some recommendations were implemented cleanly: target maturity levels with agency-head sign-off below level three (in the next policy edition), and a service catalogue and local government engagement plan (both 2023). Regulator Review's assessment: recommendations to publish a document were done; recommendations to verify a number were not.

4.6 Exercises

"CSNSW did not perform a whole-of-government exercise for 2023 … The last whole-of-government exercise was conducted in two parts, in April and September 2021." The office attributed this to the caretaker period, changes of government and reviews of the State Emergency Management Plan (IC&G 2023 p 41 / p 37 and p 50 / p 46). Coordinating exercises is one of the functions carried over from the 2017 office. The 2026-2028 Strategy now offers "Exercise-as-a-Service" to agencies (p 15).

5. ID Support NSW: the public-facing part

ID Support NSW went live in DCS on 15 December 2021 (DCS annual report 2021-22 p 56) and was integrated into Cyber Security NSW in September 2024 (DCS annual report 2024-25 p 29). It helps people whose identity documents have been stolen or misused, notifies people affected by breaches, and runs community education.

What is published about it:

• "In 2023-24, it supported more than 40,000 customers impacted by identity misuse and data compromises", and delivered "almost 200 interactive events" the previous year (ministerial release, Stronger safeguards for identity security in ID support bill, 7 May 2025).
• Calendar 2024: 101 data breaches supported and 56,466 notifications (Year in Review 2024).
• 2024-25: 182 data breaches and more than 34,000 citizens (DCS annual report 2024-25 p 29).
• "In 2024-25 ID Support provided assistance and information to more than 75,000 customers" (ministerial release, ID Support Bill passes NSW Parliament, 6 August 2025).
• The compromised ID register: "Work is underway to build the Register, with the system expected to go live next year" (6 August 2025 release). No announcement that it is operating was found at 11 October 2026.

Two figures for the same year, 2024-25, are 34,000 (annual report) and 75,000 (ministerial release), with different wording and no published definition of either. The 2023-24 figure ("supported … impacted") is worded differently again. These figures cannot be read as one series.

What is not published: any service standard (how fast a support request is answered or resolved), any timeliness result, any satisfaction result, or any complaints figure, and there is no annual report of its own. The contact page offers a form and a phone line, Monday to Friday, 9am to 5pm, and states no response time. Its home page, last updated on 15 May 2026, carries a notice that its services "are now legislated by the Identity Protection and Recovery Act 2025 … Our website content will be updated shortly to reflect this change" (nsw.gov.au/departments-and-agencies/id-support-nsw, read 11 October 2026).

Regulator Review's assessment: ID Support NSW is the most directly useful thing the office does for the public, and the law now recognises it. It is also the part of the office whose service a member of the public is best placed to judge, and nothing has been published about how quickly or how well that service is delivered.

6. A member of the public who finds a security flaw

There is no whole-of-government vulnerability disclosure programme in NSW. A framework was consulted on in late 2022 and not published (iTnews, 25 May 2023, secondary). What exists is a DCS pilot through a commercial bug bounty platform, scoped to "a limited list of domains". It promises that "Every valid report will be treated seriously and with respect", and states no acknowledgement time, no response time, no safe-harbour undertaking and no commitment to tell the reporter the outcome. Service NSW runs a separate programme and says it "cannot accept vulnerability reports on behalf of other NSW Government departments or agencies". No count of reports received has been published.

By comparison, Queensland promises to "contact you within 3 working days" and to "notify you when the matter has been addressed"; Western Australia promises a response within 5 business days and no legal action against good-faith reporters; the UK National Cyber Security Centre triages within five working days and publishes how many government vulnerabilities were remediated (working paper section 6; COMPARATORS.md).

Once a flaw is reported, whether it is fixed is the agency's decision. The office has no power to direct a fix or to check that one happened.

7. Willingness to use its powers

On the record:

• The guideline gave the office a remit from 2020-21 to audit agency self-assessments. DCS announced a Maturity Assurance Review program in October 2021 and the office was reviewing self-assessments in 2022, but the Auditor-General found in February 2023 that it had not carried out the audits. Its compliance and assurance programs were ceased in June 2022 (section 3).
• It used the levers it has in 2024 and 2025: a mandatory Essential Eight baseline, agency-head sign-off, crown-jewel inventories, and the 24-hour incident reporting directive.
• No compliance figure for the 24-hour rule has been published, although the November 2023 Strategic Plan listed "Proportion of incidents that are reported to Cyber Security NSW within 24 hours of discovery" as a KPI.

8. Systemic impact

The Auditor-General's 2023 conclusion: "Cyber Security NSW has a clear purpose that is aligned with wider government policy and objectives, but it cannot effectively demonstrate its progress toward improving cyber resilience" (CSNSW audit p 7 / p 2). The medians in section 4.2 show no improvement over four reporting years. The 2024 policy and the 2025 directive are structural changes; no data published so far shows their effect.

The office's own activity counts are mixed and measure output rather than impact: intelligence products 160 (2019-20) to "over 110" (calendar 2024); cyber security reports issued to agencies 511 (calendar 2023) to 127 (calendar 2024); training completions 191,872 (2023-24) to 126,117 (2024-25) on the departmental series (DCS annual reports 2019-20 p 38, 2023-24 p 57, 2024-25 p 29; Years in Review 2023, 2024). It has published some sector-wide measures of specific controls, for example email domain protection (DMARC) enforcement rising from 33% to 85% (Year in Review 2023).

9. Transparency about itself

9.1 What it publishes

Policy editions, circulars, a strategy, a service catalogue, guidance, and, until 2024, an annual Year in Review of activity counts. The 2023 Year in Review is the only one still on its site.

9.2 What it has never published or has stopped publishing

Item	Status	Source
Consolidated maturity or compliance result for NSW Government	Never published by the office. Qualitative statements only, e.g. scores "decreased slightly from 2020 to 2021"; "continued to improve in Financial Year 2021-22". Every consolidated figure in section 4.2 comes from the Auditor-General	Years in Review 2021, 2022; Audit Office reports
Count of incidents reported to it	No exact or consistently defined count published. "increased by 50%" (2019-20, base not stated); "triaged over 350 notifications" (2022-23); "more than 500 notifications" (2023-24); "over 200 cyber incidents" and "more than 400 notifications" (calendar 2024)	DCS annual reports 2019-20, 2022-23, 2023-24; Year in Review 2024
Result against the 2.7 to 3.0 maturity target	Not published	CSNSW audit p 21 / p 16
A document called an annual report	Promised in the 2021 Year in Review ("Cyber Security NSW will launch an annual report"). Not published; Years in Review continued to 2024	Year in Review 2021
KPI reporting	Promised in the 2023 Year in Review for mid-2024. The November 2023 Strategic Plan lists KPIs with no baselines or targets; no value has been published; the plan's PDF now returns 404	Year in Review 2023; Strategic Plan November 2023
Years in Review 2019, 2020, 2021, 2022, 2024	Removed from the live site; available only from web archive captures	digital.nsw.gov.au; Wayback
NSW Government Cyber Threat Reports	Restricted: "only shared with a restricted audience of relevant government stakeholders". The Strategy says threat assessments are now issued three times a year	Cyber Security NSW; Strategy section 5.2.3
ID Support NSW service standards, timeliness, satisfaction, complaints	Never published (section 5)	ID Support NSW pages, read 11 October 2026
Vulnerability disclosure reports received	Never published	DCS pilot page
Compliance with the 24-hour incident reporting rule	Not published, though listed as a KPI in November 2023	Strategic Plan November 2023

9.3 Changed definitions and resets

• 2020: the level three test for "met" was removed from the reporting template.
• July 2021: the Australian Signals Directorate rewrote the Essential Eight maturity model, making level one harder. This was outside the office's control.
• February 2024: the five-point scale was replaced, and 2023-24 declared "a transition period … baseline only".
• 2024: portfolio-level aggregated reporting permitted (section 3.5).
• Training completions are published on two series, financial-year (DCS annual reports) and calendar-year (Years in Review, 213,851 in calendar 2024), which are not reconciled. Intelligence products are reported partly by financial year and partly by calendar year.
• ID Support customer figures use three different wordings across two sources (section 5).

9.4 Errors and record-keeping

• The 2026-2028 Strategy says: "In February 2023, the NSW Government put in place an updated NSW Cyber Security Policy" (p 4). The updated policy was issued on 19 February 2024 (IC&G 2024 p 48 / p 44).
• The Strategy PDF as published carries "Document number: 1" and "Version number: 0.1" on its cover.
• The office's founding release, the Strategic Plan and five Years in Review are no longer at their published addresses.

Regulator Review's assessment: on the consolidated measures that would show whether NSW Government is getting safer, the office relies on the Auditor-General to publish the numbers. It promised its own annual and KPI reporting and delivered neither, and the record it did publish has largely been taken down.

10. Money

Item	Figure
Before 2020	"around $5 million per year", about 25 staff (CSNSW audit p 6 / p 1)
2020	$240m over three years: $60m for the office and $180m for agencies through the Digital Restart Fund; team "expected to grow from 25 to 100 staff" (CSNSW audit p 11 / p 6; funding decision August 2020)
Staff	87 in 2021 (Year in Review 2021); 76 ongoing positions filled, 5 contractors and 22 vacancies in March 2022 (CSNSW audit p 12 / p 7)
After 30 June 2023	The $60m expired. Press reported a $70m shortfall and later $87.7m over four years (secondary; not verified against budget papers)
September 2024	Job losses proposed; reported as at least 14, with DCS reported as saying eight employees would be affected, subject to consultation (secondary)
ID Support NSW	$22.7m over four years from the 2024-25 Budget (ministerial release, 7 May 2025; not checked against budget papers)

Per head of NSW population, the office's $60m was about $2.31 a year, against about $2.06 for Western Australia's central unit and $0.87 for Queensland's (derived; the comparator allocations are from press reports, so secondary; working paper section 7).

The funding cut after June 2023 is the government's decision. The June 2022 cessation of the compliance and assurance programs came during the funded period, three months after the last published count of 76 ongoing staff and 5 contractors.

11. Assessment and proposed grade

Findings of fact are in sections 1 to 10. This section is Regulator Review's assessment.

Scale used: A excellent; B good; C adequate; D poor; E failing; F not performing the function.

Criterion	Grade	Reason
1. Doing the core job: setting and measuring the cyber security standard for NSW Government agencies	D	It writes the policy, collects the returns and coordinates incident response, and the 2024 policy and 2025 directive tightened the standard. But it cannot say whether the sector is getting safer: the only measure is self-assessment that was overstated when tested, no result against its 2020 target has been published, and the Auditor-General found it "cannot effectively demonstrate its progress"
2. Service to the people it is there for	D	Agencies: no whole-of-government exercise between September 2021 and at least 2023; no engagement plan for the roughly 300 audit and risk committees in 2023 (CSNSW audit p 29 / p 24). Public: ID Support NSW handles tens of thousands of people a year but publishes no service standard, timeliness or satisfaction result; a person who finds a flaw in a government system has no whole-of-government channel
3. Willingness to use its powers	D	The audit remit over self-assessments from 2020-21 had not been exercised by February 2023, and the compliance and assurance programs were ceased in June 2022, nine months after the Government told Parliament the function had been established. Independent assurance arrived in 2024 only as optional guidance. This is close to E. It is D because the office did use the levers it has in 2024 and 2025 (mandatory Essential Eight baseline, agency-head sign-off, 24-hour reporting) and gave a reason (reliance on agencies' internal audit). Lack of power to compel agencies is the law's design and is not held against it
4. Systemic impact	D	Four reporting years of medians show no improvement; 2024-25 compliance is low across the board. Structural changes since 2024 may yet show results; none has been published
5. Transparency about itself	E	Never published a consolidated compliance or maturity figure, a result against its target, or a value for any of its KPIs; promised an annual report and KPI reporting and delivered neither; removed five of six Years in Review and its Strategic Plan from its site; restricts the threat reports; no exact incident count; ID Support publishes no service results. The office does publish activity counts and some control-specific measures, which keeps it above F
6. Accountability	D	Accepts most Audit Office recommendations and delivered those that required a document. The 2021 assurance recommendation remained unaddressed in 2024 and was answered with optional guidance. DCS's response to the 2021 findings, alongside announcing a Maturity Assurance Review program, was that NSW was "leading the nation". The absence of a statute and of an annual report to Parliament is the government's design and is not held against it

Proposed overall grade: D.

Reasoning. The criterion closest to the core job carries the most weight. The office does the visible parts of that job: it writes a policy, collects returns, issues products and coordinates incidents, and since 2024 it has made the standard harder to ignore. That is why it is not E. It is not C because the purpose of the job is to know whether NSW Government systems are secure and to lift them, and on the record it cannot show that it knows: it relies on self-assessments that were overstated when tested, it ceased its compliance and assurance programs without having carried out the audits it was given the remit for, it has not published a result against the one numeric target found, and every consolidated figure on the state of the sector has come from the Auditor-General rather than from the office. On transparency about itself it is failing. ID Support NSW is a genuine public service and is credited as such, but nothing published shows how well it serves the people who use it.

What would change the grade:

• Up: an annual published report of compliance by requirement and by agency (or portfolio), with exact incident counts; testing a published sample of self-assessments against evidence each year; a published result against a numeric target in the current units; service standards and annual results for ID Support NSW; a whole-of-government vulnerability disclosure programme with published timeframes and counts; restoration of the removed Years in Review.
• Down: the Auditor-General's planned performance audit (Audit Work Plan 2026-2029; IC&G 2026 p 37 / p 34) finding the self-assessments still unverified; a further change to the measurement basis before a result is published; the Strategy's promised action plan not appearing; the compromised ID register not operating by the time of the statutory review of the 2025 Act.

12. What is not known

• Aggregate NSW public sector maturity at 30 June 2023 against the 3.0 target. Not published.
• How many cyber incidents agencies have reported to the office in any year, as an exact count.
• Compliance with the 24-hour incident reporting rule since August 2025.
• How quickly ID Support NSW responds to a support request, how many requests it resolves, how many documents it has had replaced, what its customers think of it, and why two 2024-25 figures (34,000 and 75,000) differ.
• Whether the compromised ID register is operating, and how many documents are recorded on it.
• How many vulnerability reports the DCS pilot has received and how many were fixed.
• What the NSW Government Cyber Threat Reports say.
• Whether the DCS annual report for 2025-26 reports any of the above. It had not been located at 11 October 2026.
• The Public Accounts Committee's reports on the 2018 and 2023 performance audits (not obtained).

13. Sources

Cyber Security NSW and DCS: NSW Cyber Security Policy editions 2019 (v1.1), 2021-2022 (v5.0), 2023-2024 (v6.0) and 2026-2027; circulars DFSI-2019-02, DCS-2020-02, DCS-2020-05, DCS-2021-02 and directives DCS-2025-04 and DCS-2026-03; Years in Review 2019 to 2024 (2019 to 2022 and 2024 from web archive captures); Strategic Plan FY2023-24 (November 2023, web archive); Service Catalogue; 2026-2028 NSW Government Cyber Security Strategy (https://www.digital.nsw.gov.au/sites/default/files/2026-01/2026-2028-NSW-Government-Cyber-Security-Strategy.pdf); Cyber Security NSW page (https://www.digital.nsw.gov.au/delivery/cyber-security-nsw); DFSI annual reports 2017-18 and 2018-19 and DCS annual reports 2019-20 to 2024-25; DCS vulnerability disclosure pilot page; Service NSW vulnerability disclosure pages; nsw.gov.au security.txt.

ID Support NSW: ID Support NSW home page (https://www.nsw.gov.au/departments-and-agencies/id-support-nsw); Minister for Customer Service and Digital Government, "Stronger safeguards for identity security in ID support bill", 7 May 2025 (https://www.nsw.gov.au/ministerial-releases/stronger-safeguards-for-identity-security-id-support-bill); "ID Support Bill passes NSW Parliament", 6 August 2025 (https://www.nsw.gov.au/ministerial-releases/id-support-bill-passes-nsw-parliament).

Legislation: Identity Protection and Recovery Act 2025 No 45 (https://legislation.nsw.gov.au/view/whole/html/inforce/current/act-2025-045); Privacy and Personal Information Protection Act 1998 No 133, ss 59ZF, 59ZG (https://legislation.nsw.gov.au/view/whole/html/inforce/current/act-1998-133); NSW Parliament bill page, Identity Protection and Recovery Bill 2025 (https://www.parliament.nsw.gov.au/bills/Pages/bill-details.aspx?pk=18736).

Audit Office of New South Wales: Internal controls and governance 2021 to 2026; Detecting and responding to cyber security incidents (2018); Central Agencies 2019 and 2020; Compliance with the NSW Cyber Security Policy (special report, 28 October 2021); Customer Service 2021 to 2023; Cyber Security NSW: governance, roles, and responsibilities (8 February 2023); Cyber security in local government (2024); Cyber security insights 2025.

Parliament: Legislative Council Portfolio Committee No. 1, Report 52, Cyber security (26 March 2021), and the Government response (27 September 2021).

Comparators: as listed in the working paper and COMPARATORS.md.

Regulator Review working papers: Cyber Security NSW, measured by its own numbers (19 September 2026), with CSNSW-EXTRACT.md, AUDIT-OFFICE-EXTRACT.md, COMPARATORS.md, VERIFICATION.md and 00-MANDATE.md (Drive: Projects/CyberSecurityNSW).