Advisory
Published 2026-10-27 New
Verified 2026-10-27

Parliament House cyber upgrade: the Department of Parliamentary Services tells Senate estimates its Parliamentary Information and Cyber Resilience program has about $40 million over four years, starting with segmenting the parliamentary computing network, iTnews reports

The Parliamentary Information and Cyber Resilience (PICR) program has a budget of about $40 million over four years, Department of Parliamentary Services (DPS) chief operating officer and deputy secretary Nicola Hinder told Senate estimates, iTnews reported on 27 October 2026; the figure had been left out of budget papers, and Ms Hinder said the funding was first provided on a not-for-publication basis for commercial sensitivities.

According to iTnews, Ms Hinder said the money is split across three streams: information assurance, cyber uplift and work on the Parliamentary Computing Network (PCN), and the electronic security systems that underpin Australian Parliament House. iTnews reports she said one of the first PICR streams is segmenting the PCN, which is used by parliamentarians, senators and staff and connects Parliament House to ministerial and electorate offices, so that parliamentary departments set and are accountable for their own staff's settings rather than sharing the broad permissions applied to parliamentarians; the multi-year uplift runs to 2029/30. iTnews also reports that after an audit found DPS lacked a single source of truth for cyber security risks, a new cyber governance, risk and assurance team built a centralised risk register and identified 104 historical risk assessments that were marked complete but had no assessment evidence, which it is now reviewing, and that Ms Hinder said the cyber security branch has been fully staffed for close to 12 months.

Product
Australian Parliament House IT: Parliamentary Computing Network (PCN) and electronic security systems
Versions
n/a — government cyber resilience program
Exploited in Australia?
unknown
Patch to
For other agencies: keep one central cyber risk register with named owners, reassign risks when staff leave, and require evidence before marking a risk assessment complete; segment shared networks so each organisation controls its own users' settings.

australia network