1 July 2021

The Hon Brendan O'Connor MP
Shadow Minister for Defence

Mr Tim Watts MP
Shadow Assistant Minister for Cyber Security

By email: 
brendan.oconnor.mp@aph.gov.au
tim.watts.mp@aph.gov.au

Dear Mr O’Connor and Mr Watts

Request for audit of Defence’s use of Provisional ICT Accreditations

I am writing in response to your joint letter of 5 June 2021 drawing my attention to evidence provided to the Parliament by the Chief of the Defence Force and the Department of Defence’s Chief Information Officer on 2 June 2021. Specifically, you have referred to evidence regarding the Battle Management System (BMS) of Elbit Systems of Australia and the use of Provisional ICT Accreditations (PICTA) within the Department of Defence. You have also outlined specific concerns about the ICT security capacity within Defence, the prevalence of the use of PICTAs and the acceptance of associated risks.

In response to your concerns, my officials met with the Department of Defence to discuss the use of PICTAs and have reviewed relevant policy guidance in the Defence Security Principles Framework (DSPF). Defence describes the DSPF as providing governance, principles, policy, process and guidance to enable Defence personnel to make security decisions in accordance with risk. It is available here: https://www1.defence.gov.au/sites/default/files/2020-12/DSPF-OFFICIAL.pdf.

My officials have been advised by Defence that applications used by Defence must be accredited. The DSPF defines accreditation as the procedure by which an authoritative body (an Accreditation Authority) gives formal recognition, approval and acceptance of the risk(s) to an ICT system. It defines certification as the process of identifying, assessing and reporting on the risk that an ICT system presents to an information environment.

The DSPF includes ‘Principle 23: ICT Certification and Accreditation’ which sets out that the certification and accreditation process: (a) enables Defence to understand and manage security risks to classified information, security-protected assets and infrastructure; and (b) provides assurance that sufficient security measures are in place or, that deficiencies and their associated risks have been mitigated or accepted.

If the application is in operational use, it must have either a full ICT accreditation (known as an ICTA) or a provisional ICT accreditation (PICTA). The DSPF defines PICTA as a type of accreditation issued where the Accreditation Authority has requested further controls and/or risk mitigation activities to be undertaken during the provisional accreditation period. A PICTA is used where there is a need to place limitations on the use of the application, such as, accreditation duration and controls, when the application is being used during build or development activities.

To support decision-making regarding accreditation, the DSPF sets out a two-step process (a certification process and an accreditation process) for issuing an accreditation. The flowchart included in the DSPF in respect to Principle 23 (which can be found at page 303 of the DSPF) indicates that the outcome of the certification assessment will be a recommendation for either a PICTA or an ICTA to be issued. The various roles and responsibilities that support governance of the certification and accreditation processes, including the consideration and acceptance of associated risks, are also set out in the context of Principle 23.

Likewise, Principle 23 sets out the conditions that trigger reaccreditation. These conditions include, for example, policy changes, new and emerging threats and the expiration of the accreditation.

At this point I have not included an audit of Defence’s management of ICT certification and accreditation in the Australian National Audit Office’s 2021–22 Annual Audit Work Program, on the basis that Provisional ICT Accreditation is a documented process in the Defence Security Principles Framework. Further, the ANAO has audited the Land 200 program relatively recently, in Report No.40 of 2018–19 Modernising Army Command and Control — the Land 200 Program, which was presented for tabling in mid-2019.

I will however continue to review Defence’s activities and consider including such an audit in the 2022–23 Annual Audit Work Program. The work program is designed to inform the Parliament, the public and government entities of planned audit coverage to commence in the relevant year.

Yours sincerely

Grant Hehir
Auditor-General