The objective of this audit was to form an opinion on the effectiveness of Internet security measures within the Commonwealth public sector. The second objective was to provide better practice guidance for managing an Internet connection. The audit covered a range of Commonwealth agencies which had established an Internet facility. It specifically addressed the following matters : Internet security policies; site management - including change control processes, virus prevention and detection strategies, and incident response plans; controls over access to the Internet site and to data sources connected to the site; and user education and training.