Dept of Home Affairs sets out mandatory directions in national cyber security push

Australian government entities must adopt three new mandatory directions from the Department of Home Affairs Secretary as they face increased scrutiny regarding supplier vetting, conduct regular security assessments and collaborate with the Australian Signals Directorate to share threat information.

The full directions include 001-2024 managing foreign ownership, control or influence risks in technology assets. This requires entities to identify indicators of foreign ownership, control, or influence risk related to the procurement and maintenance of technology assets and to appropriately manage and report those risks.

Direction 002-2024 technology asset stocktake will require all internet-facing systems or services to identify and actively manage the risks associated with vulnerable technologies in operation, including those they manage for other entities.

Lastly, Direction 003-2024 supports cyber threat visibility. This involves participating in the Australian Signals Directorate’s Cyber Security Partnership Program and, for those using threat intelligence sharing platforms, sharing cyber threat information.

This is only the second time the government has used its binding directive powers, the first being a mandatory directive prohibiting the TikTok app on devices issued by Commonwealth departments and agencies.

These directions mark a significant step in Australia’s journey to be the world’s most secure nation by 2030, said Sarah Sloan, head of government affairs and public policy, A/NZ and Indonesia Palo Alto Networks.

“The Federal government, responsible for operating critical systems and safeguarding vital data, oversees the most essential functions of our nation from delivering social security to ensuring national defence,” she said. “It is imperative that these organisations lead in cybersecurity measures.”

Chief among these directives is the requirement that all government entities undertake a comprehensive and continuous stocktake of all internet-facing systems or services to identify and mitigate risks associated with vulnerable technologies.