Accountability and oversight

Although governance structures were described in the strategy implementation plan, in practice, it is not clear what structures are in place. A key role of such structures is to look at the overall strategic direction of the National Cyber Security Centre and to review, monitor and oversee how available resources are being used.

Recommendation 8.5

The Department should implement an appropriate governance framework for the National Cyber Security Centre.

Accounting Officer response

Agreed.

The National Cyber Security Centre is an operational unit within the Internet Policy Division of the Department and complies with the Department’s corporate governance framework. It is not a separate entity, but rather forms an integral part of the Department.

Cross-government arrangements have further developed since the 2015 National Cyber Security Strategy. This has led to an improvement in bilateral co-operation and overall governance structures relating to cyber security matters in the State. The Government’s Cabinet Committee F and the related Senior Officials Group provide an overarching forum at senior level to engage on cyber security issues. This formal interdepartmental and Cabinet level structure was not anticipated in 2015, and presents a far more coherent and central forum for the discussion of policy matters relating to cyber security.

The governance framework will be assessed and reviewed in the context of the forthcoming National Cyber Security Strategy.

The overall cost attributed to cyber security is not reported separately in the appropriation account of the Department. As a result, there is a lack of transparency around the availability and use of resources.

Recommendation 8.6

The Department should disclose separately the activity relating to the National Cyber Security Centre in its estimate and appropriation account.

Accounting Officer response

Agreed.

Expenditure relating to the National Cyber Security Centre is reported in the appropriation account under the Communications Programme in line with the Department’s vote structure.

The Department seeks to prevent operational information relating to the operations and work of the Centre from becoming public due to operational security concerns. However, the Department will work towards separately identifying cyber security expenditure in an appropriate manner in the 2019 or 2020 revised estimates for public services.