I propose to take Questions Nos. 606, 607, 608 and 609 together.
My Department's ICT managed services are provided by the Office of the Government Chief Information Officer (OGCIO). In that context, there are no contractual arrangements entered into or payments made to cyber security firms directly by my Department in recent years.
The OGCIO implements a multi-layered approach to cyber security and to protecting ICT systems, infrastructures and services. It builds resilience into its ICT solutions as a matter of course, and has disaster recovery plans and sites in a Government Data Centre. Disaster recovery forms part of the overarching Business Continuity framework for all OGCIO clients, including my Department.
My Department recognises the importance of maintaining strong cyber security awareness. Working with the OGCIO, the Department ensures all staff are mindful of, and stay up to date on, evolving threats to information security from phishing attacks, malware, as well as from an increasingly sophisticated variety of social engineering deception schemes. Commonly, such schemes involve email or other communication that invokes urgency, fear, or similar emotions, leading the victim to promptly reveal sensitive information, click a malicious link, or open a malicious file.
The Department emphasises, in particular, the importance of maintaining mobile device security, maintaining strong passwords, verifying sources of suspicious emails. Working with the OGCIO, the Department provide regular information sessions to promote vigilance among staff.
Finally, I am advised that in terms of cyber security strategies, the OGCIO also works closely with the National Cyber Security Centre (NCSC) which is a division of the Department of Communications, Climate Action and Environment. It encompasses the State's national/governmental Computer Security Incident Response Team (CSIRT-IE), an internationally accredited response team focusing on enhancing both situational awareness and providing incident response for national cyber security incidents (including ransomware attacks).