Introduction

1.1 The Australian Government’s Protective Security Policy Framework (PSPF) assists Australian Government entities to protect its people, information and assets.⁵ There are 16 mandatory core requirements in the PSPF, three of which concern personnel security. These three requirements are intended to facilitate the sharing of Australian Government resources and to mitigate the threat posed by trusted insiders.⁶

1.2 To implement the three personnel security requirements, the entity must:

• ensure the eligibility and suitability of personnel who have access to Australian Government resources, and use the Australian Government Security Vetting Agency (AGSVA) to conduct vetting, or where authorised, conduct security vetting, in a manner consistent with the Personnel Security Vetting Standards;
• assess and manage the ongoing suitability of its personnel and share relevant information of security concern, where appropriate; and
• ensure separating personnel have had their access to Australian Government resources withdrawn and are informed of any ongoing security obligations.⁷

1.3 The PSPF states that entities may use security clearances:

…where they need additional assurance of the suitability and integrity of personnel. This could be for access to security classified information, or to provide greater assurance for designated positions.⁸

1.4 In accordance with PSPF requirements, an authorised vetting agency must assess the clearance subject’s suitability to hold a security clearance, and any doubt must be resolved in the public interest.

The Australian Government Security Vetting Agency

1.5 AGSVA was established in 2010 to centrally administer personnel security vetting on behalf of the majority of Australian Government entities. It is a branch within the Department of Defence (Defence) led by the Assistant Secretary Vetting (Senior Executive Service Band 1).

1.6 Defence delivers AGSVA’s services through an allocation of 275 full-time equivalent Australian Public Service (APS) staff located across Australia. The majority (92 per cent) of security clearances are processed by external vetting providers.⁹ Defence contracts six external vetting providers, who, through a mix of employees (40 per cent) and sub-contractors (60 per cent), support the clearance process by preparing vetting assessments. Defence APS staff are responsible for making all security clearance decisions including procedural fairness processes.

1.7 In 2019–20 AGSVA completed 49,425 security clearances, including 3,327 positive vetting clearances. As at 1 July 2020, AGSVA maintained 403,888 active clearances.¹⁰ Appendix 2 of this report contains further data on AGSVA’s performance.

1.8 Defence expenditure on AGSVA services for 2019–20 was $83.26 million.

Previous Auditor-General reports

1.9 Since AGSVA was established in 2010, the Australian National Audit Office (ANAO) has conducted two performance audits of personnel security arrangements, as effective arrangements underpin the protection of the Australian Government’s people, information and assets.

• Auditor-General Report No. 45 2014–15 Central Administration of Security Vetting assessed whether Defence provides an efficient and effective security vetting service through AGSVA, and concluded that:

The performance of AGSVA has been mixed, and key Australian Government expectations relating to improved efficiency and cost savings have not been realised.¹¹

• Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security assessed the effectiveness of the Australian Government’s personnel security arrangements for mitigating insider threats, and concluded that:

AGSVA’s security vetting services do not effectively mitigate the Government’s exposure to insider threats.¹²

1.10 In the most recent report the ANAO made seven recommendations, three of which were directed to Defence.¹³ The ANAO recommended that Defence establish and make use of conditional clearances, obtain explicit informed consent from clearance subjects to share sensitive personal information with sponsoring entities, and develop a framework to enable AGSVA to share sensitive personal information with sponsoring entities.¹⁴

1.11 Further, the Auditor-General determined to omit particular information from the most recent report — in accordance with paragraph 37(1)(a) of the Auditor-General Act 1997 (the Act) — including an additional recommendation to Defence. A report including this omitted information and the additional recommendation was prepared and a copy was provided to the Prime Minister, Attorney-General, Minister for Defence, Minister for Finance and Minister for Home Affairs, under paragraph 37(5)(b) of the Act.¹⁵

1.12 Defence agreed to implement all four recommendations. The recommendations are detailed in full, with Defence’s response, at Appendix 3 of this audit report.

JCPAA Report 479: Australian Government Security Arrangements

1.13 The Parliament’s Joint Committee of Public Accounts and Audit (JCPAA) conducted an inquiry into Australian Government Security Arrangements based on the following ANAO reports:

• Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security.
• Auditor-General Report No. 43 2017–18 Domestic Passenger Screening — Follow-Up.

1.14 In April 2019, the JCPAA made three recommendations to Defence:

• expedite the Vetting Transformation project;
• establish extra safeguards and quality control measures to ensure no incidents of sensitive data loss prior to operational capacity of the new vetting system; and
• prepare a full business case to consider the current and alternative service delivery models.¹⁶

1.15 Defence agreed with qualification to implement the first recommendation, agreed to implement the second recommendation and did not agree to implement the third recommendation. The recommendations are detailed in full, with Defence’s response, at Appendix 3 of this audit report.

Rationale for undertaking the audit

1.16 Reports of parliamentary committees and the Auditor-General identify risks to the successful delivery of outcomes and areas where administrative or other improvements can be made. The appropriate and timely implementation of agreed recommendations is an important part of realising the full benefit of an audit or parliamentary inquiry, and for demonstrating accountability to the Parliament.¹⁷

1.17 Auditor-General reports released in June 2015 (Auditor-General Report No. 45 2014–15 Central Administration of Security Vetting) and May 2018 (Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security) identified ongoing deficiencies in AGSVA’s performance and made recommendations to improve the effectiveness of the Australian Government’s personnel security arrangements. Similarly, in April 2019 the Joint Committee of Public Accounts and Audit made recommendations to Defence to improve AGSVA’s effectiveness. This audit will provide assurance that recommendations made by the Auditor-General in 2018 and by the JCPAA in 2019 have been implemented in a timely manner.

1.18 This audit was identified as a JCPAA priority for 2020–21.

Audit approach

Audit objective, criteria and scope

1.19 The audit objective was to examine the Department of Defence’s implementation of agreed recommendations made in Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security and the related report provided to ministers under subsection 37(5) of the Auditor-General Act 1997, and by the Parliament’s Joint Committee of Public Accounts and Audit in Report 479: Australian Government Security Arrangements.

1.20 To form a conclusion against the audit objective, the following high level audit criteria were adopted:

• Has Defence implemented the ANAO and JCPAA recommendations to improve information technology and information security?
• Has Defence implemented the ANAO recommendations to establish and make use of conditional clearances, and to share sensitive personal information with sponsoring entities?

1.21 The ANAO reviewed Defence’s implementation of two JCPAA recommendations and four ANAO recommendations.

1.22 For two of the three recommendations directed to Defence in Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security, the recommendation was also directed to the Attorney-General’s Department. While the Attorney-General’s Department was not designated for this audit, the actions it took to revise personnel security policy requirements were considered. The audit focused on evidence of Defence incorporating these policy changes into the administration of security vetting services to implement the ANAO recommendations.

1.23 Recommendations made in Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security to entities other than Defence were not in scope for this audit.¹⁸

Audit methodology

1.24 The audit methodology involved:

• examination and analysis of relevant documentation held by Defence;
• demonstration of certain AGSVA business processes;
• analysis of data extracted from AGSVA’s security vetting case management system; and
• discussions with relevant departmental staff.

1.25 The audit was conducted in accordance with the ANAO Auditing Standards at a cost to the ANAO of approximately $341,000.

1.26 The audit team was Ailsa McPherson, Renee Hall, Kim Murray, Nate Wirihana, Song Khor and Sally Ramsey.

2.1 In April 2019, the Parliament’s Joint Committee of Public Accounts and Audit (JCPAA) completed its inquiry into Australian Government Security Arrangements, based on Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security and Auditor-General Report No. 43 2017–18 Domestic Passenger Screening — Follow-up.

2.2 In Report No. 479: Australian Government Security Arrangements, the JCPAA directed three recommendations to Defence concerning security vetting services (recommendations 3, 4 and 5). Defence agreed with qualification to implement recommendation 3, agreed to implement recommendation 4, and did not agree to implement recommendation 5.¹⁹ This chapter examines Defence’s implementation of JCPAA recommendations 3 and 4, which specifically relate to the information systems supporting security vetting services and the potential loss of sensitive personal data (see Table 2.1 below).

2.3 In the context of Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security, the ANAO conducted work in relation to the security of clearance records. The Auditor-General determined to omit particular information on this matter, including an additional recommendation agreed by Defence, from the public audit report. A non-public Auditor-General report that included the omitted information and additional recommendation was prepared and a copy was provided to the Prime Minister, Attorney-General, Minister for Defence, Minister for Finance and Minister for Home Affairs under paragraph 37(5)(b) of the Auditor-General Act 1997.

2.4 Table 2.1 sets out the three recommendations that Defence agreed to implement in full or with qualification, Defence’s assessment of the status of the recommendation and the ANAO’s summary assessment of Defence’s implementation of the recommendation. In summary, Defence has implemented one recommendation and partly implemented two recommendations.

Has Defence implemented JCPAA recommendation 3, to expedite and report back on the ICT2270 Vetting Transformation project?

2.5 The JCPAA recommendation (recommendation 3) contained three components:

• expedite the ICT2270 Vetting Transformation project;
• provide the committee with a progress report; and
• provide the committee with an updated timeline on the project.

2.6 To assess Defence’s implementation, the ANAO examined whether Defence had implemented the recommendation in accordance with its qualified response to the JCPAA. On 23 August 2019, Defence agreed with qualification to implement the recommendation, noting that:

Timings of the implementation of the ICT2270 Vetting Transformation project is subject to Defence project governance review and government approval.²⁰

2.7 Defence’s response to the JCPAA did not include an undertaking to expedite the project. The response did however provide the committee with a progress report and a broad timeline for achieving final operating capability (FOC) for ICT2270 in 2023 (thereby addressing components 2 and 3 of the recommendation). Defence’s response also noted a delay to achieving initial operating capability (IOC) due to the delivery of ICT2270 being managed in line with delivery of a Defence-wide case management system, and another related program of work to update Defence’s enterprise SAP systems. Defence’s response to the JCPAA advised that ICT2270 was on track to achieve final operating capability in 2023.

2.8 Since Defence responded to the JCPAA on 23 August 2019, there have been further delays to the IOC delivery date for ICT2270. Additional information on the project’s status is provided at Appendix 4.

2.9 Defence did not develop an implementation plan for this recommendation, and prior to responding to the JCPAA, did not review options to expedite the project (which was the first component of the JCPAA recommendation, as discussed in paragraph 2.5). Defence’s response to the JCPAA addressed the second and third components of the recommendation.

2.10 In advice to the ANAO, Defence confirmed that at this time it did not have an established enterprise governance process to record and monitor the implementation of Parliamentary recommendations.²¹

Has Defence implemented JCPAA recommendation 4, to establish extra safeguards and quality control measures to ensure no sensitive data loss?

2.11 Defence agreed to implement JCPAA recommendation 4. Defence’s response to the JCPAA (dated 23 August 2019) detailed that Defence had put in place five additional measures over the previous 12 months to strengthen security around vetting information.

2.12 Defence did not develop an implementation plan for this recommendation, and prior to responding to the JCPAA, did not: assess the effectiveness of existing safeguards and quality control measures in place to identify what extra safeguards and quality control measures were needed; or document a rationale for the additional measures to show a ‘line-of sight’ between the measure and how the risk of sensitive data loss was reduced by implementing the measure.

2.13 The ANAO’s assessment of the implementation status for the five additional measures advised in Defence’s response to the JCPAA is presented in Table 2.2.

Table 2.2: ANAO assessment of Defence’s additional measures to strengthen security for vetting information

Source: Joint Committee of Public Accounts and Audit, Government Response [Internet], Parliament of Australia, available from https://www.aph.gov.au/Parliamentary_Business/Committees/Joint/Public_Accounts_and_Audit/PersonnelSecurity/Government_Response [accessed 6 September 2020].

2.14 As shown in Table 2.2 implementation is not yet completed in respect to: Defence Industry Security Program (DISP) memberships for external vetting providers and sub-contractors under the strengthened requirements; and DISO assurance activities for DISP members’ compliance.

Requirements for external vetting providers to obtain and maintain Defence Industry Security Program membership

2.15 Defence requires all external vetting providers and sub-contractors to obtain and maintain DISP membership.²² The DISP sets minimum security standards required for industry to partner on projects at the ‘OFFICIAL’, ‘OFFICIAL: Sensitive’, ‘PROTECTED’, ‘SECRET’ and ‘TOP SECRET’ levels. To attain and maintain DISP membership, entities must meet the DISP eligibility and suitability requirements.²³ To be granted DISP membership, the applicant must meet minimum requirements for governance, personnel security, physical security and information/cyber security. Defence assesses submitted membership applications to confirm eligibility and determine suitability.²⁴

2.16 At the direction of the Australian Government, Defence established the Defence Industry Security Office (DISO) in December 2018, in response to a cybersecurity breach of a Defence contractor in 2018. DISO’s primary function is to assess how well companies are meeting their DISP membership security obligations.²⁵

2.17 Defence maintains an excel spreadsheet (register) used to track DISP membership application requirements and assurance activities.²⁶

Assurance activities of DISP membership requirements for external vetting providers

2.18 Defence has undertaken the following assurance activities of DISP membership requirements for the six (prime) external vetting providers and the 117 sub-contractors listed in Defence’s tracking spreadsheet.

Sampling assessments

2.19 In July and August 2020, Defence completed a ‘light touch’ ‘sampling’ assessment for five of the six prime external vetting providers, to validate some of the information provided in the DISP membership application.²⁷ Specifically, Defence sought evidence that: the five prime external vetting providers had seven key security governance arrangements in place; and the organisations’ security officer had ‘an understanding of their DISP security obligations’.²⁸ Defence concluded that:

• two of the five external vetting providers had all seven documents in place;
• two of the five external vetting providers had six of the seven documents in place;
• the remaining external vetting provider had three of the seven documents in place.

2.20 Defence further concluded that four of the five security officers interviewed showed an understanding of their DISP security obligations. The security officer that did not show an understanding of their DISP security obligations worked for the same external vetting provider that had three of the seven security governance arrangements in place.

Cybersecurity questionnaires

2.21 In June 2020 Defence received responses to its cyber security questionnaire from its six prime external vetting providers.²⁹ Defence assigned one of four possible cyber security maturity ratings: ‘Embedded’; ‘Managing’; ‘Developing’; and ‘Ad hoc’. Defence assigned four of the six prime external vetting providers a maturity rating of ‘Embedded’ (the highest rating possible) and two received a rating of ‘Managing’ (the second highest rating possible).

Deep dive audit

2.22 In September 2020, Defence completed its report of a ‘deep dive’ audit of one of its six prime external vetting providers. The objective of the audit was to assess the security maturity of the provider against the standards listed in the Defence Security Principles Framework Control 16.1. Defence concluded that the organisation’s four security domains (governance, personnel security, physical security, and information and cybersecurity) were ‘Developing’.³⁰

2.23 Defence made 10 recommendations to improve the organisation’s compliance with its DISP membership requirements. The external vetting provider agreed to six recommendations and partly agreed to four recommendations. Defence advised the ANAO that to close the audit, Defence will either conduct a follow-up review or request confirmation in writing from the external vetting provider that the audit recommendations have been addressed.

Foreign Ownership, Control and Influence

2.24 The purpose of Defence’s review of Foreign Ownership, Control and Influence (FOCI) information provided in the DISP application is to form a view on whether the provider entity has any FOCI affecting the management or operations of the contracted entity, in a manner which could result in unauthorised access to classified information or adversely affect the performance of contracts.

2.25 As at July 2020, Defence had reviewed the completed FOCI Assessment form for each of its six prime external vetting providers. The review by Defence showed Defence assessed that there were no concerns raised about foreign ownership, control and influence over these providers.

Assurance activities for vetting provider sub-contractors

2.26 Table 2.3 shows the status of the sub-contractors listed in Defence’s tracking spreadsheet for DISP membership application requirements and assurance activities.

Table 2.3: Status of sub-contractor DISP application requirements and assurance activities as at 13 August, 30 September and 30 October 2020

Note: Data as at 13 August 2020 shows the status of sub-contractor DISP application requirements and assurance activities during ANAO fieldwork. Data as at 30 September 2020 shows the status of applications after ANAO fieldwork was completed, and data as at 30 October 2020 was the most recent data available. Defence advised the ANAO that COVID-19 circumstances slowed the delivery of security officer training.

Source: Defence documentation.

Instances of loss or mishandling of sensitive data

2.27 During the course of this audit, Defence investigated one incident of sensitive data mishandling and identified one incident of sensitive data loss in the past year.³¹

2.28 The first incident occurred on 17 December 2019. A package containing two paper-based personnel security files, sent by a sub-contracted vetting officer to one of the six prime external vetting providers using a regular overnight (door to door) delivery service, was not received.³² A Defence investigation report for the incident stated that the consignment note was dislodged during transit and the courier applied its procedures to identify the package, which included opening the package. The package was identified by the courier and sent to the vetting provider on 20 January 2020. The courier advised the investigator that it had ‘offered to discuss with AGSVA different levels of secure services to put in place safeguards’, and that if the item had not been opened, it would not have been recovered.³³ Following the incident, in January 2020 Defence directed, via an email instruction to external vetting providers, that all packages must be sent in double envelopes and the destination address affixed to both layers of packaging.

2.29 The second incident occurred on 16 April 2020, when a paper-based personnel security file for an NV1 clearance was lost during transit while being transported by the courier. Defence tracks the movement of personnel security files through an allocations register, consignment advice emailed between Defence and the external vetting provider, and the use of the courier’s consignment tracking portal. On 21 May 2020, Defence was informed by the external vetting provider that the file was unable to be located.³⁴ Defence advised the ANAO that the courier’s electronic tracking was not functioning at the time of the incident, and the other mechanisms did not alert Defence that the file had not arrived. Defence further advised the ANAO that it initiated, through the courier firm, national depot searches which did not locate the package.

2.30 On 25 June 2020, Defence informed the affected individual of the loss and advised the individual not to engage with anyone purporting to be from AGSVA, except for nominated AGSVA members. The affected individual was also provided details of the Office of the Australian Information Commissioner and IDCARE (which assists to reduce harm from compromise and misuse of identity information). On 23 July 2020, AGSVA reported the incident to Defence’s privacy office. On 31 August 2020 Defence’s privacy officer determined the incident was a notifiable data breach and Defence reported the incident to the Office of the Australian Information Commissioner.

2.31 Defence contract managers met with the courier firm to discuss potential improvements following the second incident. Defence advised the ANAO that following the meeting, Defence and the courier put in place new communication arrangements to escalate and improve responses where packages are not delivered in agreed times. A brief to Defence’s Associate Secretary dated 20 October 2020 advised on the incidents and Defences’ response to the incidents, including that Defence:

• had issued a Contract Notice for all security vetting providers to formally advise on the appropriate notification and escalation processes to be followed if a parcel was delayed or misplaced, and to confirm Defence’s and the courier’s requirements for packaging and sending parcels. Defence would conduct further verification activities with external vetting providers to ensure appropriate procedures were followed;
• would issue a further Contract Notice to the two external security vetting providers involved in the two security incidents, due to delays in notifying Defence of a missing package. If the correct procedures were not followed in the future, sanctions would be considered;
• was reviewing the courier’s service delivery requirements; and
• was assessing options on using alternative ways to allocate personnel security files.

2.32 Defence proposed to provide a regular report on personnel security file management to the Associate Secretary, to ensure the Associate Secretary was informed regarding AGSVA performance and incidents, as Chair of the AGSVA Governance Board. The Associate Secretary noted the response to the incidents, and agreed to the proposal for a regular report, on 31 October 2020.

Has Defence implemented the ANAO recommendation contained in the non-public report prepared under subsection 37(5) of the Auditor-General Act 1997?

2.33 Auditor-General Report No. 38 2017–18 Mitigating Insider Threats through Personnel Security reported on the ANAO’s follow up audit on shortcomings identified in the security of clearance records in Defence’s ICT systems during the course of a previous audit, reported on in Auditor-General Report No. 45 2014–15 Central Administration of Security Vetting.³⁵

2.34 As part of the second audit the ANAO reported that:

2.52 At the time of the ANAO’s previous audit, Defence had conducted two reviews of AGSVA’s information security. The reviews had identified that Defence was not compliant with all of the requirements of the Australian Government Information Security Manual and found deficiencies in the controls framework surrounding AGSVA’s clearance records which could lead to unauthorised access and loss of information.

2.53 The ANAO conducted further work in this area. In accordance with section 37(1)(a) of the Auditor-General Act 1997 (Cth) (the Act), the Auditor-General determined to omit particular information relating to this matter, including an additional recommendation to Defence, from this public report. The reason for this is that the Auditor-General is of the view that such information would be contrary to the public interest in that it would prejudice the security, defence or international relations of the Commonwealth, as per section 37(2)(a) of the Act.

2.54 In accordance with section 37(5)(b) of the Act, a report including the omitted information and additional recommendation has been prepared and a copy provided to the Prime Minister, the Attorney-General, the Minister for Defence, the Minister for Finance and the Minister for Home Affairs.

Management of the security of vetting information

2.35 The security of vetting information is provided through Defence’s: manual handling requirements for physical file transfers during a vetting assessment; hardcopy personnel file storage facilities; and the eVetting system. The eVetting system comprises:

• the Personnel Security Assessment Management System (PSAMS2) — which acts as a vetting case management system;
• ePack 2 — which allows clearance subjects to complete and submit security vetting packs through an online portal; and
• the Security Officer Dashboard — an online portal that allows security officers in entities to look up limited information about clearance subjects.

2.36 Since 2016, Defence has been implementing a program of work to remediate vulnerabilities in the eVetting system to reduce the assessed level of information security risk.

2.37 After the non-public audit report was provided to the Prime Minister and relevant Ministers on 11 May 2018, Defence advised the Defence Minister in May 2018 that in response to the additional recommendation, Defence:

… plans to realise many process improvements through procuring a new ICT system … which is expected to be fully operational in 2023. Until the system is fully implemented AGSVA has projects in place to strengthen ICT controls.

2.38 Defence advised the Defence Minister in July 2018 that Defence had implemented the audit recommendation. Defence also informed the AGSVA Governance Board in June 2018 that Defence had implemented the recommendation.³⁶

2.39 Defence has not provided further reporting to the AGSVA Governance Board about the progress of activities to remediate vulnerabilities in the eVetting system. Reporting by Defence on the management of risk in the eVetting system would strengthen the Board’s oversight of AGSVA and system-level risks, and would be consistent with the Board’s terms of reference, which state that it will provide:

… strategic oversight of AGSVA, including its control and accountability systems. The Board will also monitor the progress of service delivery, business reform and major systems development.

2.42 Defence does not have an established governance process for the implementation of a recommendation contained in a non-public Auditor-General report. The recommendation contained in the non-public report was:

• not recorded in Defence’s Audit Recommendation Management System because this system cannot store information classified above the protected level. However, the management action plan for the implementation of recommendations contained in the public audit report (Auditor-General Report No.38 2017–18 Mitigating Insider Threats through Personnel Security) noted that the non-public recommendation was completed. The management action plan was signed by the First Assistant Secretary Security and Vetting Services Division on 25 June 2018; and
• not reported to the Defence Audit and Risk Committee, as would normally occur for recommendations made to Defence by the ANAO.

2.43 On 9 July 2018, the Assistant Secretary Vetting reported internally to Defence’s Audit and Fraud Control Division that the audit recommendation was implemented and could be closed.

System life of type extension agreed November 2018

2.44 On 2 November 2018 Defence assessed the residual risk of the eVetting system as reduced from ‘extreme’ to ‘high’.³⁷ Defence noted that: ‘the time and materials required to re-architect the current system [to further mitigate the identified risks] were unjustifiable’, given the estimated cost of project ICT2270 which was expected to remediate the same risks in a comparable timeframe. Defence therefore accepted the ‘high’ residual risk and agreed to a life of type extension (LOTE) for the system in November 2018.

2.45 The ANAO’s review of subsequent internal Defence reporting indicates that remediation activities to reduce the eVetting system’s risk level remained incomplete as at September 2020. Of the nine key risk areas, two have been completed, five have been partly completed, and two have not been completed.

2.46 The ANAO identified inconsistencies in Defence documentation relating to the remediation activities. In Defence’s technical documentation, the remediation activities are described as being fully and successfully implemented. Defence’s eVetting sustainment progress reporting provided to the Assistant Secretary Vetting and the Assistant Secretary Enterprise Technology Operations (in Defence’s Chief Information Officer Group) indicates that remediation activities are only partly completed.

2.47 A second program of remediation activity was agreed within the LOTE (November 2018) to further reduce risk from ‘high’ to ‘significant’. Defence’s progress reporting indicates this second program of remediation is partly completed.

Reporting and governance of eVetting system risk

2.48 The November 2018 LOTE system certification is valid until the delivery of a replacement system, and was agreed ‘subject to the continual review of the existing system’.

2.49 At an operational level, the existing system is monitored through an eVetting sustainment stakeholder group.³⁸ Meeting records from April to July 2019 and LOTE summary reports from April to August 2020 indicate that Defence is tracking the eVetting risks and LOTE remediation activities.³⁹

2.50 The LOTE was also agreed subject to regular risk reporting to the Secretaries’ Cyber Strategy Committee and Government Security Committee.⁴⁰ An eVetting Governance Board was also expected to review and report on the system’s risk profile on a six-monthly cycle until the planned decommissioning date of mid-2021. Defence could not provide evidence that the reporting agreed in the LOTE had occurred. Defence should either meet the LOTE requirement for regular risk reporting to the committees listed in the LOTE, or amend the requirement.

3.1 Three recommendations were directed to Defence in Auditor-General Report No.38 2017–18 Mitigating Insider Threats through Personnel Security, relating to improved processes for conditional clearances and information sharing. Defence agreed to implement each recommendation.

3.2 Table 3.1 sets out the recommendations, Defence’s assessment of implementation status and the ANAO’s summary assessment of progress with implementation.

Table 3.1: Assessment of Defence’s implementation of ANAO performance audit recommendations

Note: Two of the three ANAO recommendations were also made to the Attorney-General’s Department as it is responsible for supporting entities in the implementation of the Protective Security Policy Framework.

Source: ANAO analysis of departmental documentation.

Enterprise governance arrangements for implementation of ANAO performance audit recommendations

3.3 Defence has established processes to govern the implementation of ANAO performance audit recommendations.⁴¹ In summary the processes involve:

• assigning management responsibility for implementing each recommendation to an individual at the Senior Executive Service (SES) level;
• recording each recommendation in the Audit Recommendation Management System (ARMS) to facilitate tracking the progress of implementation;
• providing advice to the Defence Audit and Risk Committee when recommendations are not implemented by the approved estimated completion date; and
• reviewing evidence of implementation and closing the recommendation.

3.4 In addition to Defence’s established processes outlined above, for these three recommendations the AGSVA Governance Board provided additional oversight of, and received updates on, implementation progress.⁴²

3.5 Defence generally followed its established processes to plan, monitor and report on its implementation of the three recommendations. Of the 13 procedures involved, Defence did not fully complete four procedures, namely to: approve the management action plan; update progress monthly in the ARMS; submit timely requests for extensions to the Audit and Fraud Control Division; and maintain records of extensions granted.

Consultation with the Attorney-General’s Department

3.6 The two ANAO recommendations concerning conditional clearances (recommendation 1) and the framework for information sharing (recommendation 3) required Defence to consult, or undertake joint action with, the Attorney-General’s Department. The ANAO viewed evidence of Defence’s consultation with the Attorney-General’s Department, and undertaking joint action during the implementation of the two ANAO recommendations, through:

• Defence’s membership of the Government Security Committee⁴³;
• the Attorney-General’s Department’s membership of the AGSVA Governance Board;
• the Secretary of the Department of Defence and the Secretary of the Attorney-General’s Department jointly presenting to the Secretaries’ Board in February 2020 on progress towards establishing the risk-sharing framework (ANAO recommendation 3); and
• Attorney-General’s Department staff participation in Defence’s operational level workshops and meetings.

Has Defence implemented ANAO recommendation 1, to establish operational guidelines for, and make appropriate risk-based use of, conditional clearances?

3.7 Auditor-General Report No.38 2017–18 Mitigating Insider Threats through Personnel Security found that AGSVA’s security clearances did not provide sufficient assurance to entities about personnel security risks, as Defence had not established operational guidelines to apply the Australian Government’s protective security policy on conditional clearances. Recommendation 1 of that audit was for Defence to establish, and make appropriate risk-based use of, conditional clearances.

3.8 To assess Defence’s implementation of the recommendation, the ANAO examined whether it had been implemented in accordance with the management action plan and whether Defence closed the recommendation appropriately.

3.9 The management action plan stated that Defence would develop, trial and implement the operational guidelines by January 2019. Defence subsequently decided to implement the recommendation after establishing the new external vetting provider panel arrangements in August 2019. The date for implementation was therefore amended from January 2019 to July 2020, and later further amended to September 2020, due to COVID-19 restrictions impacting on the ability to deliver training to contracted vetting officers.

Vetting Risk Model and associated user guide

3.10 To implement the recommendation, Defence, in consultation with the Attorney-General’s Department, developed a Vetting Risk Model (VRM) and associated guidelines. The VRM is intended to ‘ensure structured and uniform reporting of residual risk as mandated in the Protective Security Policy Framework’.⁴⁴ Defence expect the VRM to ‘form the basis of the core risk model within the future vetting system’ (the ICT2270 Vetting Transformation project, see Appendix 4) and that:

Once operationalised the system’s embedded and integrated, structured risk model will replace the current VRM tool, enabling vetting officers (both internal and external to AGSVA) to complete vetting analysis within the system.

3.11 The VRM guides vetting officers through the seven risk factor areas identified in the Protective Security Policy Framework (PSPF) to inform a ‘whole of person risk rating’ and security clearance recommendation. The assignment of risk factor area ratings, the ‘whole of person risk rating’, and the recommendation to grant, deny or revoke a security clearance are not automatically generated, rather these are decisions made by the vetting officer using their professional judgement.⁴⁵ The completed VRM is then provided to a Defence Australian Public Service (APS) authorised decision maker who decides whether to grant a security clearance.⁴⁶

3.12 Granting a security clearance with conditions may be considered when the vetting officer assigns the clearance subject a whole of person risk rating of either ‘moderate-high’ or ‘high’ and ‘a recommendation to deny/revoke the clearance is warranted’.⁴⁷ The VRM user guide states that in this situation the vetting officer is required to initiate a ‘procedural fairness process’. If, following the procedural fairness process, Defence determines that the residual risk has not reduced to an acceptable level (through a treatment that is accepted by the sponsoring entity and the clearance subject to manage the realised risk), Defence may determine that a conditional clearance is an appropriate way of managing the residual risk, or may deny the clearance.

3.13 Under the PSPF, Defence can only grant conditional clearances (clearances issued subject to maintenance requirements/conditions) where the sponsoring entity and the clearance subject agree to the proposed maintenance requirements.⁴⁸ This agreement is documented in a ‘conditional clearance agreement’ negotiated between Defence, the sponsoring entity and the clearance subject.

Risk-based use of clearance maintenance requirements

3.14 In accordance with the management action plan, Defence trialled the VRM by mandating its use by all APS vetting officers, for all new vetting cases, from 1 September 2018. Training of contracted external vetting providers in the use of the VRM started in October 2019 and Defence advised the ANAO that all external vetting officers (those employed and sub-contracted) had completed training and were using the VRM from 17 September 2020.⁴⁹

3.15 Defence informed the ANAO of the assurance processes over vetting decisions made using the now superseded form — Vetting Analysis Report (VAR) — during the rollout period:

During the rollout of the VRM, recommendations made by an ESVS [external security vetting supplier] company on a VAR to deny/revoke a security clearance were reviewed internally, and the identified risks and mitigations applied using the VRM. If a case was identified as a grant, with residual risk [that is, a recommendation is made to the delegate to grant a security clearance], a VRM was completed in order to progress with risk sharing. Assurance is provided through the role of the Authorised Decision Maker, internal to AGSVA.

3.16 Defence stores the completed VRM in its case management system (PSAMS2) as an attached document, without a field or flag showing which form (VRM or VAR) was used to support the vetting assessment. Therefore, Defence cannot readily report on the number of clearances processed using each form during the rollout period, without manually checking each clearance. Defence expects that once the ICT2270 vetting system is operationalised (estimated to be Q4 2022):

The system’s embedded and integrated, structured risk model will replace the current VRM tool, enabling vetting officers (both internal and external) to complete vetting analysis within the system.

3.17 On 24 April 2020, Defence closed the ANAO recommendation in its Audit Recommendation Management System, and advised the Defence Audit and Risk Committee (DARC) at the committee’s July 2020 meeting that the recommendation was closed. Defence’s closure of this recommendation in April 2020 was premature, as not all contracted vetting officers had completed training and were therefore not yet using the VRM. Defence’s advice to the AGSVA Governance Board and the DARC to close the recommendation did not state the completion date for training.

Has Defence implemented ANAO recommendation 2, to obtain explicit informed consent from clearance subjects to share sensitive personal information with sponsoring entities?

3.18 Auditor-General Report No.38 2017–18 Mitigating Insider Threats through Personnel Security reported that AGSVA’s consent form did not explicitly obtain informed consent from clearance subjects to share information with entities. Recommendation 2 of that audit was that Defence obtain explicit informed consent from clearance subjects to share sensitive personal information with sponsoring entities.

3.19 To assess Defence’s implementation of the recommendation, the ANAO examined whether Defence had implemented the recommendation in accordance with the management action plan and reviewed the closure pack that informed the decision to close the recommendation.

3.20 The management action plan stated that Defence would seek legal advice from the Australian Government Solicitor (AGS), integrate that advice into an updated informed consent form, then develop a plan to incorporate the revised form into security clearance procedures. The management action plan stated the recommendation would be implemented by July 2018.

Revised informed consent form

3.21 In June 2018, Defence obtained legal advice from AGS on whether the informed consent form provided sufficient consent to allow Defence to collect and/or disclose the sensitive information of clearance subjects, including specific information on security concerns regarding the clearance subject, and mitigating factors identified through the vetting process, to their sponsoring entities/employing agency. AGS suggested changes to the form, which Defence incorporated into a revised informed consent form. The revised form was implemented from 2 July 2018.⁵⁰ Defence’s security clearance procedures do not allow processing to commence until the clearance subject has provided informed consent by way of a signed form.

3.22 On 6 July 2018, Defence closed the recommendation in its Audit Recommendation Management System.

3.23 The ANAO noted during this audit that security clearance procedures had been updated to incorporate the revised form, however there were two instances where procedures referenced the superseded informed consent form. In response, Defence developed a plan to review all of its policies, procedures and guidelines, to ensure they reflect the implementation of the revised informed consent form, the VRM and the risk information sharing framework. Defence advised that it intended to complete this review by 9 October 2020.

Has Defence implemented ANAO recommendation 3, to facilitate AGSVA providing sponsoring entities with specific information on security concerns and mitigating factors?

3.24 Auditor-General Report No.38 2017–18 Mitigating Insider Threats through Personnel Security reported that AGSVA did not share information about security concerns outside Defence and therefore had not met the intent of the Australian Government’s 2014 policy reform.⁵¹ Recommendation 3 of the audit was that the Attorney-General’s Department and Defence establish a framework to facilitate information sharing.

3.25 To assess Defence’s implementation of the recommendation, the ANAO examined whether Defence implemented the recommendation in accordance with the management action plan, and reviewed the closure pack that informed the decision to close the recommendation.

3.26 The management action plan stated that Defence would implement the VRM (discussed in paragraph 3.11), develop protocols and procedures for management and use of shared risk information, develop relevant guidance, trial the framework, seek Government Security Committee endorsement, and implement the framework. Implementation was to be completed by January 2019.

Protective Security Policy Framework requirement to share information

3.27 The Attorney-General’s Department issued a revised PSPF in October 2018.⁵² The revised PSPF requires vetting agencies to share relevant ‘information of security concern’ about security clearance holders with sponsoring entities.⁵³ Under the Personnel Security Adjudicative Guidelines, a determination of whether information is of security concern can only be made by the vetting agency assessing that concern.⁵⁴ Defence will only share information where there is an ongoing risk that is not mitigated, and the information is relevant to managing potential security concerns.

Development of the Personnel Security Risk Information Sharing Framework

3.28 In accordance with the management action plan, the Attorney-General’s Department and Defence developed the ‘Personnel Security Risk Information Sharing Framework’ to facilitate Defence providing sponsoring entities with specific information on security concerns and mitigating factors identified through the vetting process.⁵⁵

3.29 The Personnel Security Risk Information Sharing Framework comprises the VRM and its user guide, and other guidance documents, including:

• the Security Clearance Informed Consent form;
• document templates to facilitate Defence sharing relevant security risk information with the sponsoring entity;
• processes to share relevant personnel security risk information between Defence and the sponsoring entity, including thresholds for what information Defence will share; and
• a package of guidance and resources to assist agency Chief Security Officers and their support staff to manage personnel security risk information shared by Defence.

3.30 If Defence determines that risk information is to be shared, Defence will share information with sponsoring entities through a Risk Advisory Notice, Residual Risk Advice, or Conditional Clearance Agreement (see Table 3.2).

3.31 The Government Security Committee endorsed the risk sharing framework at its 12 October 2019 meeting and agreed to the implementation plan for the framework at its 12 December 2019 meeting.

Implementation of the Personnel Security Risk Information Sharing Framework

3.32 Defence is implementing the Personnel Security Risk Information Sharing Framework in phases, with priority given to Negative Vetting 2 and Positive Vetting security clearances. Table 3.3 summarises the phases and progress of Defence’s implementation of the framework.

Table 3.3: Implementation of the Personnel Security Risk Information Sharing Framework

Source: Department of Defence documentation and advice to the ANAO.

3.33 While Defence is implementing the framework in phases, the implementation approach has not impeded the sharing of risk information between Defence and entities which were not part of the pilot, phase one or phase two of the framework’s roll-out. Defence advised the ANAO that:

There have been instances of risk information … being shared with [entities not included in the pilot, phase one or phase two]. These have been managed similarly to the risk sharing framework.

3.34 In February 2020, the Secretaries of Defence and the Attorney-General’s Department presented a joint paper to the Secretaries’ Board, which included an update on the personnel security risk sharing framework developed by the two departments.⁵⁶

3.35 On 24 April 2020, Defence closed the recommendation in its Audit Recommendation Management System. The Defence Audit and Risk Committee was informed that the recommendation was closed at its 9 July 2020 meeting.

Appendix 1 Department of Defence response

Appendix 2 AGSVA delivery of vetting services — data

1. As at 1 July 2020, AGSVA maintained 403,888 active security clearances at current clearance levels (Table A.1).⁵⁷ This represents a 36 per cent increase from 295,103 (as at 1 September 2017) reported in Auditor-General Report No.38 2017–18 Mitigating Insider Threats through Personnel Security.⁵⁸

Table A.1: Active security clearances, current clearance levels^a, as at 1 July 2020

Note a: AGSVA also manages 107,778 active clearances at security clearance levels issued prior to 2010 which are not included in Table A.1.

Source: ANAO analysis of AGSVA clearance data.

2. Table A.2 shows that over the past three financial years, AGSVA has made an average of 48,504 security vetting decisions annually, with the majority (82 per cent) of decisions at the Baseline and NV1 clearance levels.

Table A.2: Security vetting decisions^a by clearance level, 2017–18 to 2019–20^b

Note a: The ANAO has defined a vetting decision as a decision made by AGSVA between 2017–18 and 2019–20 to grant, deny or revoke a security clearance. This excludes ‘reviews for cause’, cancellations and other administrative outcomes ‘rejected’ and ‘approved’.

Note b: Data for single years provided by Defence, data for ‘average’ and ‘all years’ columns calculated by ANAO.

Source: ANAO analysis of AGSVA clearance data.

3. To request a clearance, the clearance subject must be sponsored by an Australian Government entity.⁵⁹ Defence industry clearances are sponsored by the Department of Defence or by Defence Industry Security Program accredited entities.⁶⁰ For reporting purposes, AGSVA groups clearance sponsors into three categories: Defence, Defence industry and other government entities. Defence and Defence industry combined sponsor the highest proportion of clearances for each clearance level (Figure A.1).

Figure A.1: Percentage of vetting decisions^a by sponsor type^b, 2019–20^c

Note a: The ANAO has defined a vetting decision as a decision made by AGSVA between 2017–18 and 2019–20 to grant, deny or revoke a security clearance. This excludes ‘reviews for cause’, cancellations and other administrative outcomes ‘rejected’ and ‘approved’.

Note b: Defence industry includes Defence Industry Security Program (DISP) sponsored and Defence sponsored industry.

Note c: Not all totals add to 100 per cent due to rounding.

Source: ANAO analysis of AGSVA clearance data.

4. For the time period 2017–18 to 2019–20, the outcome of the majority of vetting decisions was to ‘grant’ a clearance (76 per cent). Table A.3 sets out the outcomes for all clearance cases between 2017–18 and 2019–2020 (Table A.3).

Table A.3: Clearance case outcomes^a by clearance level, 2017–18 to 2019–20

Note a: Includes initial, upgrade and revalidation cases; excludes ‘reviews for cause’.

Note b: ‘Other’ is comprised of the administrative outcomes ‘approved’ and ‘rejected’.

Source: ANAO analysis of AGSVA clearance data.

Appendix 3 List of recommendations examined

Appendix 4 Project status — ICT2270

ICT2270 Vetting Transformation project

1. In 2016, the Australian Government agreed a suite of reforms to improve government agencies’ management of the threat posed by malicious insiders. The Government noted at this time that Defence would upgrade the Australian Government Security Vetting Agency’s (AGSVA) ICT system to support implementation of a number of these reforms. This new capability was intended to support the ongoing assessment of the suitability of security cleared staff, share risk information on clearance subjects between AGSVA and sponsoring entities, and allow vetting agencies to corroborate information provided by clearance subjects with automated links to Commonwealth data sources.

2. The ICT2270 Vetting Transformation project is a key enabler for achieving the government’s agenda. In November 2017 Defence told the Defence Investment Committee that:

ICT2270 underpins key elements of the Government’s strategy for Mitigating the Malicious Insider Threat, as well as enabling a more automated and efficient vetting service. Government has an expectation that the Sub-Program will begin implementation of a solution to assist with mitigation of the malicious insider threat by 2020. Delays to ICT2270 will result in delays to the WoG [whole of government] reform agenda for security.

3. Defence’s August 2019 response to the Joint Committee of Public Accounts and Audit (JCPAA) recommendation to expedite ICT2270 and provide the Committee with a progress report and updated timeline on implementation of the replacement ICT system, noted that first pass government approval had been achieved in April 2018 and second pass was scheduled for Quarter 1 2020.⁶¹ The first pass advice to government noted that the Project was investigating options to accelerate the schedule.

4. Table A.4 shows the key government and Defence decision points for progressing the ICT2270 project since the Government’s decision to support a new vetting capability in 2016.

5. Table A.4 shows that since Defence provided a project timeline to the JCPAA in August 2019, government has twice approved a delay for second pass consideration for project ICT2270. Defence documentation indicates that the reasons for delay include project complexity and concerns with cost and schedule, which have prompted Defence to assess alternatives.⁶²

6. Subject to government agreement, at Initial Operating Capability Defence is expected to deliver the core vetting system that will replace the current vetting ICT system, which is operating under a Life of Type Extension (see paragraphs 2.44 to 2.47 of this audit report), and replace existing manual business processes (see paragraphs 2.27 to 2.32). Project documentation presented to the Defence Investment Committee in September 2020 for approval (Gate 2) indicates that IOC is estimated to be realised in 2022, with Final Operating Capability to be delivered in 2023, subject to government agreement. Defence estimated that the acquisition costs of the Vetting Transformation project from April 2018 to April 2020 had increased by approximately $5 million.⁶³