Top Government cyber security committee idle since 2015

A top-level Government committee tasked with developing cyber security policy has not met since July 2015, the C&AG has said.

This inter-departmental committee is supposed to work as a steering group for and, at some stage, an oversight body of, the National Cyber Security Centre.

The centre, which is responsible for securing critical national infrastructure, government networks and assisting industry, is operating largely from rented accommodation in UCD.

The C&AG report said the NCSC was established in 2011 with an initial budget of €800,000, but that between 2012 and 2015 it only received annual funding of €250,000.

Between 2012 and 2016 the staffing at the centre only grew from five to eight.

Commenting on the initial funding for the centre, the report said: “The department’s funding allocation for cyber security in the period 2012 to 2015 was less than a third of the amount approved in 2011.”

“The National Cyber Security Centre performs a critical ‘whole-of-government’ function. However, the level of resourcing in the first four years was significantly less than that initially envisaged.”

Only when its budget rose to €1.95m in 2017 did staffing reach 14. The department said approval was given this year to appoint a further 16 staff including a permanent director and chief technical officer.

The C&AG said the Department of Communications, Climate Action and Environment is responsible for cyber security policy, which it discharged through the NCSC.

The report said the centre contains the Computer Security Incident Response Team, which deals with national cyber security incidents. It said a National Cyber Security Strategy was published in July 2015.

The C&AG said a commitment to a memorandum of understanding in relation to national security and policing with An Garda Síochána was not completed.

The report said the high-level interdepartmental committee had met five times (though minutes of only one meeting were found) between December 2013 and July 2015 and has not met since.

The committee consists of an assistant secretary from the Department of Communications and the Department of the Taoiseach, a Garda Assistant Commissioner, a principal officer at the Department of Justice, a colonel from the Defence Forces and a counsellor from the Department of Foreign Affairs and Trade.

The C&AG called for a review of resourcing for the centre and said overall strategic direction was “not clear” and no strategic plan was in place.

The Department told the C&AG it had sent a draft memorandum to the Gardaí in 2017 but that “discussions are ongoing”.

It said operational effectiveness was not impeded.

It said there was ongoing shared training and that a garda was seconded to the centre and a second garda would follow soon.