Cyber Security Risks for Local Councils
Cyber Security Risks for Local Councils
Thursday, 1 October 2026
Key takeaways
- The NSW Audit Office’s Local Government 2025 report found that 73 per cent of councils do not have formal policies addressing supply chain cyber security risks
- 70 per cent of councils had not conducted formal risk assessments of their technology assets, limiting their ability to identify and manage cyber threats
- Control weaknesses over system access were identified in 71 councils, including gaps in granting, removing and monitoring user access
- Cyber security framework adoption has grown from 20 per cent in 2019 to 91 per cent in 2024, but policy implementation remains inconsistent
- Councillors and executives responsible for governance need to understand cyber risk as a strategic issue, not a technical one delegated entirely to IT
Cyber security risk in Australian local government is no longer a technical concern managed by IT departments. It is a strategic governance issue that councillors and executives must understand, oversee and resource. In one example, the NSW Audit Office’s Local Government 2025 report found that 73 per cent of councils do not have formal policies addressing supply chain cyber security risks. 70 per cent had not conducted formal risk assessments of their technology assets. Control weaknesses over system access were identified in 71 councils. These are not isolated technical failures. They are governance gaps that audit offices are now reporting publicly and that councillors will be expected to explain.
What are auditors finding in local government cyber security?
The pattern across multiple audit reports is consistent. For example, the NSW Audit Office Cyber Security Insights 2025 found that while cyber governance has improved (74 per cent of councils now have a cyber security policy, up from 20 per cent in 2019), significant gaps remain in implementation. The ACSC Essential Eight was the most commonly adopted framework (71 per cent of councils), but adoption of a framework does not mean compliance with it. The report found that policies often lacked clear accountability for core cyber security functions.
The Information Age analysis of the VAGO audit summarised the findings bluntly: none of the reviewed local governments had up to date plans to detect, respond to and recover from cyber incidents. The Victorian Auditor-General found a significant rise in poor IT security controls across the sector. These findings are not new. They are recurring, which makes them harder for governance bodies to explain away.
Why is cyber risk a governance issue for councillors?
Councillors are responsible for the governance of their council. Under the Local Government Act 1993 (NSW) and equivalent legislation in other states, this includes oversight of risk management. From 1 July 2024, NSW councils are required to have a risk management framework and internal audit function that comply with the OLG Guidelines for Risk Management and Internal Audit and to attest to compliance in their annual reports. Cyber risk falls squarely within this framework.
A councillor does not need to understand firewall configurations. They need to understand whether the council has identified its critical technology assets, whether it has assessed the risks to those assets, whether it has allocated adequate resources to address the highest priority risks and whether the Audit, Risk and Improvement Committee (ARIC) is receiving meaningful reporting on cyber security posture. These are governance questions, not technical ones.
What should councils prioritise?
The NSW Audit Office recommendations provide a clear starting point. By 30 June 2026, councils should strengthen supply chain risk management governance, improve investment accountability by tracking the return on cyber security spending and manage underutilised or outdated security tools. The Local Government 2024 report also recommended that councils identify all information assets requiring protection (36 per cent had not done so) and ensure that residual cyber risk sits within the council’s stated risk appetite (37 per cent of councils that had assessed their residual risk rated it above appetite).
For councils with limited resources, shared arrangements can help. The 2025 report includes a case study of councils collaboratively sharing a Chief Information Security Officer. The report describes the benefits and lessons learned from that arrangement.
How can councillors and executives build capability?
AcademyGlobal (AG), the Chartered Institute of Procurement & Supply (CIPS) Centre of Excellence for Australia, New Zealand and Southeast Asia, delivers programs that build strategic risk governance capability. AG’s Strategic Risk Management for Councillors and Executives program addresses how elected members and senior leaders can fulfil their governance obligations around risk, including cyber risk, without needing technical expertise. For professionals seeking broader risk management capability, AG’s Risk Management Fundamentals program provides the structured foundation for identifying, assessing and managing organisational risks.
Cyber risk is no longer something councils can delegate to IT and forget. The audit evidence shows that governance bodies that do not actively oversee cyber risk are the ones where the gaps persist.
Frequently asked questions
Why is cyber security a governance issue for councillors?
Councillors are responsible for the governance of their council, including oversight of risk management. From 1 July 2024, NSW councils must attest to compliance with the OLG risk management guidelines in their annual reports. Cyber risk falls within this framework.
What did the NSW Audit Office find about council cyber security?
The 2025 report found that 73 per cent of councils lack supply chain cyber security policies, 70 per cent had not risk assessed their technology assets and control weaknesses over system access were found in 71 councils.
Do councillors need technical cyber security knowledge?
No. Councillors need to understand whether the council has identified its critical assets, assessed the risks, allocated resources and whether the ARIC is receiving meaningful cyber security reporting. These are governance questions.
What framework should councils adopt?
The ACSC Essential Eight is the most commonly adopted framework (71 per cent of NSW councils). The OLG Cyber Security Guidelines provide sector-specific guidance.
Where can councillors build risk governance capability?
AcademyGlobal’s Strategic Risk Management for Councillors and Executives program builds strategic risk governance capability for elected members and senior leaders.