Introduction

1.1 The purpose of the Department of Foreign Affairs and Trade (DFAT) is to make Australia stronger, safer and more prosperous, to provide timely and responsive consular and passport services, and to ensure a secure Australian Government presence overseas.² In 115 posts across 86 countries, DFAT is responsible for ensuring a consistent and efficient use of government resources overseas, including managing properties, staff and conditions of service, health and safety, security, information and communications technology, and finance.

1.2 An overseas Australian Government presence has been identified as fundamental to Australia’s ability to meet strategic challenges, protect Australians overseas and advance Australia’s interests abroad.³ Reflecting this, managing the Australian Government’s overseas network is one of six key activity areas for the department.

1.3 In its 2023–24⁴ and 2024–25⁵ Annual Reports, DFAT assessed that it had ‘achieved’ both performance measures relating to that activity.

• ‘Australian Government staff, information and assets overseas are protected through appropriate risk-focused security measures’; and
• ‘The overseas property estate is effectively maintained and fit for purpose’.

1.4 DFAT is responsible for all aspects of security policy affecting Australian missions and staff attached to DFAT. Two high-level Australian Government policies inform DFAT’s responsibility for, and management of, security at Australia’s overseas posts.

• The Prime Ministers’ Directive: Guidelines for the Management of the Australian Government Presences overseas sets out DFAT’s responsibility for ‘the implementation of appropriate physical, technical, information and personnel security procedures, measures and standards.’ This directive was issued by the Prime Minister in 2007 and was last revised in 2010.
• The Australian Government Protective Security Policy Framework (PSPF) sets out the Australian Government policy across six security domains and prescribes what Australian Government entities must do to protect their people, information and resources. For example, the PSPF sets out that all Australian Government international facilities, including missions, posts, embassies and consulates, are required to meet the PSPF requirements and be included in the managing entity’s annual PSPF report on security.⁶

Australia’s diplomatic network

1.5 DFAT reporting indicates its 115 posts are staffed by approximately 1072 Australian employees and 2147 locally engaged staff overseas as of 30 June 2025.⁷ Some other Australian Government agencies have official interests that require presence overseas at DFAT posts, with the larger agencies overseas including the Department of Home Affairs, Australian Trade and Investment Commission, Department of Defence and Australian Federal Police.

1.6 Australia’s diplomatic posts range in size from large offices to small posts. Posts comprise of a chancery facility (embassy, high commission or consulate building) and staff residences.

1.7 Some security responsibilities are held by the Head of Mission or Post. The Head of Mission/Post is supported by the Deputy Head of Mission/Post who, in addition to their primary diplomatic role, holds the Post Security Officer role and is responsible for the day-to-day management of security arrangements.

1.8 DFAT has 31 Regional Security Officers (RSOs) (29 located overseas and two based in Australia). RSOs are responsible for supporting either one or multiple posts within a region, through activities such as security risk assessments, inspections, supporting procurement of security equipment by identifying the need for procurement and defining security requirements, and provision of security advice.

Previous Auditor-General reports and reviews

1.9 The Auditor-General has previously reviewed the protection of missions and staff overseas in two audits.⁸ The audits recommended that DFAT improve security guidance and training, security risk management, the implementation and effectiveness of security measures in mitigating risk and the monitoring of security at overseas posts. The findings and conclusions of the 2017 Auditor-General report were considered by a 2018 inquiry of the Joint Committee of Public Accounts and Audit (JCPAA). The JCPAA inquiry report made an additional eight recommendations focussed on security governance, cyber security and security training.⁹

1.10 DFAT engaged a former departmental official in April 2018 to undertake a review of the Chief Security Officer’s obligations under the Work Health and Safety Act 2011 and under the department’s Officer Due Diligence Manual. In addition, Comcare wrote to DFAT in May 2018 setting out that, should a work health and safety issue occur, Comcare would investigate whether due diligence was exercised and may verify if DFAT actions to the ANAO recommendations were implemented. The review was presented to the Department Security Committee in July 2018 and made 39 recommendations. Thirty-two recommendations were accepted by the department.

Security enhancements program

1.11 Successive reviews from 2005 to 2017 (including the two ANAO performance audits) identified deficiencies in the effectiveness of DFAT’s security arrangements. Since November 2018, the Australian Government has provided additional funding on three occasions to improve security at overseas posts.

1.12 DFAT received $394.3 million ($338.8 million in 2018–19 and $55.5 million in 2020–21) to deliver the ‘Security Enhancements Program’ (SEP). DFAT received an additional $81.2 million in the 2024–25 Federal Budget to strengthen security at DFAT’s overseas posts including increased inspections and continuation of implementation of security asset upgrades (delivered under a separate program as set out in paragraph 1.22).

1.13 The program objectives were focussed on satisfying the Government’s duty of care to provide a safe and secure environment for staff and visitors to Australia’s overseas missions. The SEP was described by DFAT as the ‘vehicle’ through which DFAT implemented ANAO’s recommendations.

Governance arrangements

1.14 The governance arrangements for delivery of the SEP were approved by the Operations Committee¹⁰ in February 2019 and are set out in Figure 1.1. There were nine projects to be delivered under the SEP. The largest project related to the relocation of two embassies (Project G), with a budget allocation of $157.1 million or 43 per cent of the total approved SEP budget. The second largest project related to an uplift of security assets at overseas posts (Project A), which had a budget allocation of $96.9 million or 25 per cent of the overall SEP budget. Further information on each of the project’s scope delivered under SEP are set out in Appendix 3.

1.15 As set out in Figure 1.1 below, reporting arrangements were in place for the program to DFAT’s Senior Executive.

• Each project reported to a dedicated project board, except for Project G which was subject to existing property governance arrangements at some stages during SEP.¹¹ The SEP Project Board oversaw delivery of eight projects, and the Embassy Security Upgrades Board oversaw delivery of Project I.
• The project boards reported to the SEP Program Board, which was responsible for setting the strategic direction of the program and ensuring the business case remained viable, made decisions about matters of importance in the program and provided clear direction to the program on managing threats to program benefits.
• The department’s Operations Committee provided program sponsorship and ensured alignment of the program with the broader direction of DFAT. Project G was to directly report to the Operations Committee, while providing budget and progress reports to the SEP Portfolio Management Office.

Figure 1.1: SEP governance arrangements

Source: ANAO analysis of DFAT documents.

1.16 Another feature of the program governance arrangements included ‘live assurance’, where a contracted firm provided reporting to the SEP Program Board and Operations Committee about the overall status of the program, project delivery and program governance. Reporting did not cover the two embassy relocations (Project G). The reporting was provided on a quarterly basis between June 2019 to February 2022 and twice per year between February 2022 and June 2023.

Program delivery

1.17 SEP was deemed to be closed by the department in December 2023. This meant that formal program governance arrangements were closed including ending of reporting of project status to the SEP Program and Project boards and ending of assurance arrangements. Project delivery continued until 30 June 2025. As set out in Figure 1.2, between 1 January 2019 and 30 June 2025 the department’s expenditure on the program was $258.4 million (66 per cent of the approved total budget). A total of $63.9 million (25 per cent of program expenditure) was spent post program closure.

1.18 The highest total expenditure on a single project was the security assets and infrastructure project (Project A). Between January 2019 and June 2025, a total of $101.7 million was spent on Project A, representing a total of 39 per cent of total program expenditure. This was followed by expenditure on Project G ($32.4 million or 13 per cent of program expenditure) and the mitigating the insider threat project (Project F) (28.6 million or 11 per cent of program expenditure).

Figure 1.2: SEP expenditure per project between January 2019 and June 2025

Source: ANAO analysis of DFAT expenditure data.

Benefits realisation

1.19 The Security Enhancements Program Benefits Framework and associated SEP Benefits Realisation Plan were developed and approved by the SEP Program Board in October 2019, 11 months after the policy was agreed by the Australian Government.¹² There were 10 benefits defined for SEP. Each project delivered under the SEP related to multiple benefits (refer to Appendix 4).

1.20 The purpose of the SEP Benefits Realisation Plan was to ‘fully define the benefits and confirm how success will be measured’. At the time the benefits plan was approved there were 50 metrics that were measured to ascertain whether program benefits were achieved. While each benefit included defined metrics to measure progress towards achieving benefits over time, targets and data sources for these metrics were not clearly established in all cases.

1.21 There was not a clear baseline established to measure program benefits against: metrics and targets changed throughout the life of the program. For example:

• By August 2022, the number of metrics had increased from 50 to 74, related to the introduction of the SEP Tranche 2 projects and additional metrics added for the Security Equipment and Measures System and Mitigating the Insider Threat projects.
• Some targets associated with metrics for achievement of project benefits were also changed. For example, one of the metrics related to installation of security assets was the number of Type 1A alarms installed. The target was reduced in February 2021 from 90 alarms to 50 alarms installed.

Hardening the Diplomatic Network

1.22 DFAT also received additional funding of $81.2 million in the 2024–25 Federal Budget (‘Hardening the Diplomatic Network’) to strengthen security at overseas posts including increased technical countermeasures inspections and continued implementation of improved security infrastructure. Implementation of this measure remains ongoing, with funding due to expire in June 2028.¹³

Rationale for undertaking the audit

1.23 The audit was undertaken because of the importance of the Australian Government’s overseas network. DFAT is responsible for the safety and security of people (including its officers and attached agencies), information and physical assets overseas. Substantial funding has been provided to DFAT to deliver the SEP.

1.24 This audit provides independent assurance to the Parliament over the effectiveness of DFAT’s implementation and benefits realisation of the upgrades under the SEP.

Audit approach

Audit objective, criteria and scope

1.25 The audit objective was to assess whether the expected benefits from the Security Enhancements Program and Hardening the Diplomatic Network have been realised.

1.26 To form a conclusion against the objective, the ANAO examined:

• Did DFAT effectively implement property projects and realise the expected benefits?
• Did DFAT effectively implement the security infrastructure and assets projects and realise the expected benefits?
• Did DFAT effectively implement the monitoring projects and realise the expected benefits?

Audit methodology

1.27 The audit methodology included:

• review of department data, documentation, procedures and training;
• walkthroughs of the department’s systems and processes;
• attendance at DFAT security training for staff posted overseas; and
• meetings with departmental staff.

1.28 The audit team undertook overseas fieldwork at three DFAT posts in Europe, Asia and the Pacific to provide insight into the implementation of security enhancement program upgrades at posts. At each post, the audit team inspected the security arrangements both inside and outside the post, Head of Mission/Post residence and/or other staff residences and met with DFAT and attached agency staff.

1.29 The ANAO engaged the Australian Security Intelligence Organisation T4 Protective Security (ASIO-T4), to provide protective security advice based on the Australian Government PSPF standards in relation to physical security measures, security standards and risk management. The PSPF security standards form the minimum security standard DFAT should apply overseas where practical, given the limitations of operating in a foreign environment. ASIO-T4 assisted the ANAO’s review of the effectiveness of physical security measures in place at the DFAT posts visited as part of the audit.

1.30 The audit did not include a review of:

• with respect to the Security Enhancements Program, DFAT’s implementation of the Security Clerance Management System (Project C) and Mitigating the Insider Threat (Project F).
• with respect to the Hardening the Diplomatic Network measure, security training and infrastructure maintenance.
• DFAT’s delivery of domestic security and cyber security arrangements.

1.31 Australian Government entities largely give the ANAO electronic access to records by consent, in a form useful for audit purposes. For the purposes of this audit, DFAT advised the ANAO that it would not voluntarily provide certain information requested by the ANAO due to concerns about its obligations under the Privacy Act 1988 and other portfolio legislation. To provide comfort to DFAT regarding its obligations under portfolio legislation, on 10 June 2025 the Auditor-General issued the Secretary of DFAT with a notice to provide information and produce documents pursuant to section 32 of the Auditor-General Act 1997. Under this notice, DFAT agreed to provide the requested information and documents.

1.32 The audit was conducted in accordance with ANAO Auditing Standards at a cost to the ANAO of approximately $727,000.

Omission of sensitive information

1.33 In accordance with paragraph 37(1)(a) of the Auditor-General Act 1997 (the Act), the Auditor-General has not included particular information in the public report. The Auditor-General has formed an opinion that disclosure of particular information would prejudice the security, defence or international relations of the Commonwealth, as per paragraph 37(2)(a) of the Act.

1.34 In accordance with subsection 37(5) of the Act, a report including the particular information has been prepared and a copy provided to the Prime Minister, the Finance Minister and the Minister for Foreign Affairs.

2.1 The total value of the land and building assets managed by DFAT was $3.9 billion as of 30 June 2025. The department also manages fit-out, furniture, equipment and motor vehicle assets located in both owned and leased properties (domestic and overseas).

2.2 There were two projects that related to property improvements under the SEP: Project G (relocation of two embassies) and Project I (security upgrades at one embassy). The property projects represented the highest value category of investments to be delivered by DFAT under the SEP, representing a combined total of 43 per cent of the budget allocated at the stage funding was approved by the Australian Government.

What were the expected benefits from the property projects?

2.3 The property projects related to three overseas locations.

2.4 There were two benefits related to the property projects. These benefits were risk reduction due to relocation of at-risk missions (benefit seven) and enhanced compliance with duty of care obligations under the Work Health and Safety Act 2011 (benefit nine). The department set out seven metrics related to the realisation of these benefits as related to the property projects (refer to Table 2.1). As of 30 June 2024, by which time the department had closed the program (see paragraph 1.17), DFAT reported that five of seven metrics were completed.¹⁴

Table 2.1: SEP benefits related to property projects

Note a: ANAO analysis indicates that this metric was not complete as of 30 June 2024 (refer to paragraph 2.25).

Note b: These metrics were added to benefit 7 and 9 in August 2020 following the approval of SEP Tranche 2 in the 2020–21 Budget.

Source: ANAO analysis of DFAT records.

Were the activities to realise the benefits effectively delivered, including on time and within budget?

Schedule

2.5 Figure 2.1 illustrates the original plan for the delivery of Project G (relocation of two posts) and Project I (embassy security upgrades), compared to the delivery status of the projects as of February 2026.

Project G post relocation projects

2.6 Figure 2.1 reflects that DFAT relocated both posts in 2019 to interim facilities. The Australian Government approval provided in November 2018 related to the permanent relocation of overseas missions and did not include funds to cover interim relocations because they were not part of DFAT’s plan.

2.7 Both relocations to an interim facility were made in 2019 for the stated purpose of staff safety.

• Safety concerns were identified in the first location in August 2018 following a DFAT internal security inspection. Planning for relocating the chancery, including to an interim site, commenced in the same month. Interim relocation of the mission was approved by the department in November 2018 due to heightened staff safety risks.
• The requirement for interim relocation in the second location was driven by staff safety concerns as the chancery ‘building has been identified as at risk of collapse in the event of a major earthquake’. These concerns were known since at least 2010.¹⁵

2.8 SEP funds were approved by the department to be used to cover the cost of interim relocations. The financial risk with the department’s approach was acknowledged in communications between DFAT finance officials who noted that ‘a decision has been taken to use … funds to cover the interim works. This poses a financial risk that there may not be adequate funds to cover the entire proposed program of works.’ As of December 2025, this financial risk had not been realised due to the permanent relocation projects not having been progressed sufficiently to warrant the full funding that had been budgeted for permanent relocations.

2.9 Key milestones for the establishment of a permanent facility in the first location have occurred later than originally planned. As of February 2026, key milestones that have been achieved on the project include appointment of a prime contractor in March 2022, Public Works Committee approval in March 2023, and site establishment and services relocation, achieved in June and July 2024.

2.10 The project has experienced delays due to:

• impacts of the COVID-19 pandemic¹⁶;
• additional time required to achieve the 50 per cent schematic design milestone and longer than DFAT’s forecast time for approval by the Public Works Committee;
• delays to commencement of construction (achieved March 2024, when compared to October 2022); and
• quality issues identified during the delivery of building materials to a facility in Australia. The prime contractor was required to submit a remediation plan and documentation for review by the departments’ third-party engineer.

Figure 2.1: Timeline of key phases of the property projects

Note a: In February 2026, DFAT advised the ANAO that the forecast timeframe for post occupation is October 2026.

Source: ANAO analysis of DFAT documents.

2.11 The current forecast date for post occupation in the first location (as of December 2025) is September 2026. Compared to the schedule included in the original Stage 2 Project Development and Delivery Plan (PDDP), this represents an approximate 3.2-year delay to finalisation of the project.

2.12 For the second location, DFAT’s business case approved in February 2019 indicated that it expected opening of a permanent chancery facility by June 2025. ANAO analysis of DFAT’s documentation indicates that this project did not finish the due diligence and procurement of land phase before the suspension of post operations in August 2025. Before this suspension, DFAT was considering whether it should extend the lease on the interim facility or relocate to another building to maintain its diplomatic presence.

Project I embassy security upgrades project

2.13 As set out in Figure 2.1, the design and tendering phase of the embassy security upgrades project extended beyond the July 2021 deadline set out in the department’s Project Development and Delivery Plan. The department selected a contractor through a sole source tender to lead design consultancy services and project management services in September 2021.¹⁷

2.14 The scope of the contract was reduced in September 2022 due to the contractors’ performance in the design phase and head works contractor phase (which the department described as ‘sporadic at best’). This contractor also unsuccessfully ran a competitive procurement approach to engage construction subcontractors, which received no responses. Following this, an Australian-based contractor was selected through a sole source tender in November 2022 to provide construction management services. Construction on the project commenced in May 2023, 20 months later than planned.

2.15 The construction phase of the project has also extended beyond initial project estimates, with DFAT experiencing issues in the timeliness and quality of perimeter works delivered. The end date of the contract has been extended from 30 June 2024 to 30 June 2026, affecting the practical completion date of the works. DFAT advised the ANAO in November 2025 that while the contractor has claimed practical completion for portions of the work, DFAT had not issued a certificate of practical completion and is ‘withholding this certificate until [the contractor] has satisfactorily rectified all defects, which it expects by the contract end date’.

2.16 In July 2024 and January 2025, a portion of works was removed from the scope of the contract due to DFAT’s assessment of poor contractor performance. This included works at one of the entry/exit driveways and internal works at the chancery, including a new public screening room, guard post and mail room. This portion of works is now referred to as ‘Stage 2’.

2.17 DFAT advised the ANAO in November 2025 that a new Project Development and Delivery Plan for Stage 2 is under development and DFAT is determining the timeframe for Stage 2. While security issues with the embassy were first identified in 2015, no contractor has yet been engaged to complete the works and there is no forecast completion date for the project.

Budget

2.18 As discussed in paragraph 2.2, the combined budget for the property projects allocated at the government approval stage was $170.3 million or 43 per cent of total combined SEP funding. As illustrated in Figure 2.2, between January 2019 and June 2025, the department spent a combined total of $44.4 million on these projects, comprised of $32.4 million on Project G (post relocation project) and $12 million on Project I (embassy security upgrades).

2.19 There has been a significant underspend on Project G (post relocation project), with 21 per cent of the original budget allocation being spent. The highest total expenditure occurred in 2019–20 ($21.5 million), associated with the temporary relocation of both embassies during that financial year. The underspend reflects that the department has not progressed with the acquisition of land in one location. The schedule delays in the first location have also driven the underspend, with key milestones connected to payment of the prime contractor yet to be achieved.

2.20 DFAT has spent 91 per cent of the budget initially allocated to Project I with a significant portion of the security upgrades yet to be delivered such as works to improve the security of the embassy façade and entry and exit driveway. DFAT advised the ANAO in February 2026 that ‘DFAT will fund the remaining upgrades for Project I from existing departmental appropriations. The department is reviewing the quantum of the upgrades to ensure they meet the current threat and risk profile of the post’.

Figure 2.2: Expenditure on Project G and I between 1 January 2019 and 30 June 2025

Source: ANAO analysis of DFAT financial data.

Assurance

2.21 As discussed in paragraph 1.16, while the property projects were the projects with the highest value budgets, they were not included in the program’s independent assurance arrangements. The arrangements were established to provide the Security Enhancements Program board with ‘external perspectives and analysis to the Program Board and Operations Committee.’ Reporting indicated that the post relocation project (Project G) was excluded from the scope of the reviews. The rationale for the exclusion was not documented.

What benefits have been demonstrably obtained from the property projects?

Interim facilities

2.23 As set out in Table 2.1, three of the seven benefits metrics for the property projects related to relocation of staff in the two locations to interim chancery facilities. The relocation of staff to interim facilities was completed at both locations in December 2019 and February 2020.

Permanent relocations

2.24 Permanent relocation of one embassy is ongoing. On site works for the permanent facility commenced in March 2024 and are forecast for completion in April 2027 (as of December 2025). As referenced in paragraph 2.11, this is more than three years later than originally planned. The department’s assessment of its realised benefits in June 2024 that the permanent facility in the second location was complete is incorrect.

• While relocation of the embassy to an interim facility was completed in December 2019, activities to establish a permanent facility were not progressed beyond the due diligence stage as of December 2025. DFAT had not achieved any of the ‘Stage 2 (new build)’ milestones it set out in its initial business case for the relocation, such as procurement of land, approvals design and tender phase and fit out and building services installations.
• In August 2025, the Australian Government suspended embassy operations in that location citing staff safety reasons. The Secretary also decided in September 2025 to not renew the lease on the interim facility and to let the lease expire in February 2026. The briefing to the Secretary set out the financial implications of the decision, including a make-good settlement to be negotiated.
• As of December 2025, DFAT had identified the permanent relocation of the embassy to the Minister for Foreign Affairs as part of its initial immediate savings to be brought forward as part of the 2026–27 Federal Budget process.’¹⁸ DFAT advised the ANAO in May 2026 that the estimated saving as of December 2025 was ‘121.9 million over four years from 2026–27 and $9.3 million ongoing from 2030–31’.

Security upgrades

2.25 As of February 2026, the embassy security upgrades project has been partly completed. Some of the vulnerabilities first identified in 2015 have been remediated, with improvements made to the perimeter of the embassy, one entry/exit driveway and the residential pavilion. There were defects with the works delivered during Stage One. For example, there were repeated breakdowns in the hydraulic pumps on the bollards to one of the entry/exit driveways between August 2024 and November 2025. There were also failures experienced with the new door installed in the residential pavilion in June 2025.

2.26 Defects were rectified by October 2025. As discussed in paragraph 2.16, a portion of the works remain outstanding, with there being no contractor or timeframe yet on when Stage 2 works will be completed.

24/7 guarding

2.27 The DFAT Security Roles and Responsibilities Tool sets out that security guarding costs are funded by an overseas posts’ budget. Security guarding services 24 hours per day, seven days per week were initially recommended in the 2016–17 financial year until the additional perimeter mitigations were completed. Additional security guarding funding was provided to cover shortfall in the posts’ budgets through the SEP between July 2020 and June 2023 at a cost of $360,336.

2.28 As of February 2026, 24/7 security guarding remains in place due to delays experienced in the embassy security upgrades project. A 2024 Regional Security Officer inspection report commented that:

Post has repeatedly put in requests to DFAT to have this issue addressed, including and as a minimum, requesting approval to approach the current provider for ongoing guarding at least until the perimeter project has finished.

The current contract is due to expire on 16 December 2024 and the Post is unable to commence any further negotiations or consider other contractors until DFAT provide the necessary approval.

2.29 A new security guarding contract commenced on 1 December 2025. DFAT advised the ANAO in February 2026:

DFAT advises that [removed] post operating budget has been supplemented to meet the ongoing cost of the guarding contract, with funding provided from the departmental budget for both 2023–24 and 2024–25 financial years.

The requirement for security guarding at every Post is regularly reviewed against threat and risk in the region. Even though the perimeter fence upgrade funded by SEP is now complete, the threats and risks continue to warrant a 24/7 guarding presence…

3.1 The Department of Foreign Affairs and Trade’s (DFAT) Security Framework (DSF) sets out that security assets are a physical item, infrastructure or system used for the protection of people, information or assets. Security assets can be equipment required by a security policy or features implemented by design or standards to mitigate a specific threat or risk. Figure 3.1 illustrates DFAT’s application of security-in-depth principles (including examples of security measures deployed) at overseas posts, where layers of security measures are applied to provide layered protection that correspond to the value of the asset or information requiring protection.

Figure 3.1: DFAT’s application of security in depth at overseas posts

Source: ANAO analysis of DFAT records.

3.2 There were two projects that related to security assets and infrastructure improvements under the SEP: Project A (security infrastructure upgrades) and Project H (armoured vehicle upgrades). These upgrades represented the second highest value category of investments to be delivered by DFAT under the Security Enhancements Program (SEP), representing a combined total of 30 per cent of the budget allocated at the government approval stage. Further funding was provided in the 2024–25 Federal Budget through the Hardening the Diplomatic Network measure to continue security infrastructure upgrades at overseas posts.

What were the expected benefits from the security infrastructure and assets projects?

3.3 Auditor-General Report No. 5 2017–18 found that (based on evidence from four posts) DFAT’s security measures at overseas posts were not being effectively managed and maintained in all cases. The Auditor-General recommended that:

• DFAT enhance the coordination of the deployment of security measures to achieve greater consistency when determining security measures to be deployed overseas (recommendation 4); and
• DFAT strengthen arrangements for managing and maintaining security measures at overseas posts to ensure the measures appropriately mitigated identified risks (recommendation 6).¹⁹

3.4 The Review of the Chief Security Officer’s Work Health and Safety Due Diligence responsibilities (Nash review), completed in 2018, found ‘there is a lot of equipment at posts which has reached its end-of-life and may represent a safety risk as a result.’. Equipment with a book value of $123 million (or 40 per cent of the total of $312 million) fell into this category. The review recommended that consideration be given to developing a rolling program of asset replacements based on up-to-date threat and risk assessment and ‘serious consideration be given to developing a New Policy Proposal.’

3.5 Two reviews (the Nash Review and a review by a contractor engaged by DFAT) indicated that there were significant deficiencies with DFAT’s management of its armoured vehicle fleet. For example, key findings of the second review were that there was no through life capability process for armoured vehicles. The review found that there was little evidence that any vehicles acquired had been certified ‘fit for purpose’ or maintained to the manufacturers’ specifications.

Security Enhancements Program

3.6 Following results of the earlier audit and reviews, the Australian Government agreed to provide funding to enhance DFAT’s security assets and infrastructure (Project A) and armoured vehicles (Project H).

• DFAT received $96.9 million to upgrade security assets and infrastructure at DFAT overseas posts (Project A), including upgrades of security alarm systems to Type 1A, upgraded Electronic Access and Control systems (EACS), upgraded Closed Circuit Television (CCTV) and improved Public Screening Equipment such as Walk Through Metal Detectors (WTMD) and X-Ray machines.
• DFAT received $20.5 million in the 2020–21 Federal Budget to upgrade its armoured vehicle fleet, engage a prime contractor to manage the capability life cycle and improve governance arrangements (Project H).

3.7 There were seven benefits related to the security assets and infrastructure upgrades. The department set out 22 metrics related to the realisation of these benefits. Benefits from these projects largely related to benefit one: enhanced mitigation capabilities through delivery of new technology to counter physical threat (seven metrics), benefit five: risk reduction due to increased technical surveillance and counter-measure capability (four metrics) and benefit three: enhanced detection of hostile foreign intelligence services (three metrics).

3.8 As of 30 June 2024, the department reported that it had completed 20 of 22 metrics related to the projects. The department’s tracking also set out that there were two metrics ‘cancelled by the program board’.²⁰ In addition to achieving benefits, the security assets and infrastructure project formed part of the department’s response to implementing Recommendation 6 from the 2017 Auditor-General report (refer to paragraph 3.3) and its response to issues identified in the Nash Review.

Hardening the diplomatic network security infrastructure upgrades

3.9 DFAT was provided with $56.7 million in funding through the 2024–25 Federal Budget to continue upgrading security infrastructure at 60 overseas posts. As set out in Figure 3.2, DFAT defined one benefit in relation to this project: increased information security and people security via fit-for-purpose physical and electronic security upgrades. There were two key outcomes and three measurements related to achievement of these outcomes.

Figure 3.2: Security infrastructure upgrades benefit profile

Source: ANAO analysis of DFAT’s records.

Were the activities to realise the benefits effectively delivered, including on time and within budget?

Security assets and infrastructure

3.10 DFAT planned to finish security asset and infrastructure upgrades at 50 to 60 posts by 30 June 2023.²¹ The department planned to adopt a phased delivery approach to security upgrades.

• Phase 1 was to demonstrate upgrades of Type 1 alarms to Type 1A alarms and CCTV at seven pilot posts by December 2019.
• Following the pilot phase, the department planned its delivery approach by geographic region to ‘enhance co-ordination and minimise disruption to posts.’ Regions were to be prioritised based on financial asset depreciation schedules so replacements were focussed on assets reaching the end-of-life. The first region to be identified for rollout was the Middle East, to be finalised by 30 June 2020.

3.11 The project plan did not identify what upgrades posts in geographic regions would receive, nor the relationship to posts’ risk assessment or financial depreciation schedules. The plan did not specify roles and responsibilities for security upgrades such as whether upgrades would be planned and delivered centrally by the Diplomatic Security Division (DSD) or whether responsibility for upgrades would be divided between posts and DSD.

3.12 Security upgrades were delayed by Australia’s international travel restrictions which occurred as a result of the COVID-19 pandemic. The department changed its delivery approach to address these restrictions and progress asset upgrades. For example:

• DFAT selected posts to implement asset upgrades at based on travel restrictions, rather than geographic regions.
• Some upgrades were led by overseas posts (with support from DSD) and other upgrades were managed by DSD as set out in Figure 3.3. Overseas posts were primarily responsible for upgrades of security assets in the controlled area and at staff residences.

Figure 3.3: DFAT’s delivery approach

Source: ANAO analysis of DFAT’s delivery records.

3.13 As demonstrated in Figure 3.4, DFAT finalised completion of the security upgrades in June 2025, two years later than originally planned. DFAT received a two-year extension to SEP Project A funding due to the international travel restrictions discussed in paragraph 3.12. Reflecting the initial planned phased approach and international travel restrictions, the number of security upgrades completed was low in the first two financial years of the SEP (six assets in 2018–19 and twenty seven in 2019–20). The number of security asset installations increased in 2020–21, with 61 public screening assets such as X-Rays and Walk Through Metal Detectors (WTMD) purchased in the financial year. The highest number of security asset projects were completed in the final year of SEP (2024–25), including completion of 36 CCTV installations, 22 EACS installations and delivery of 16 Trace devices.²²

Figure 3.4: Security assets and infrastructure upgrades by asset type, 2018–19 to 2024–25

Note: The ANAO could not verify that the posts had received the upgrades set out in DFAT’s benefits tracking, including the number of assets purchased and installed set out in this figure. Refer to paragraph 3.23 below for further discussion.

Source: ANAO analysis of DFAT data.

3.14 DFAT spent $101.7 million on the security asset and infrastructure upgrades between July 2019 and June 2025. This was five per cent higher than the SEP allocation of million, funded from underspends in other SEP projects. As illustrated in Figure 3.5, the highest expenditure occurred on upgrades in the restricted area at posts ($42.5 million or 42 per cent of expenditure on this project) and the controlled area of posts ($39. 1 million or 38 per cent of expenditure on this project).

Figure 3.5: Security asset and infrastructure expenditure, 2018–19 to 2024–25

Source: ANAO analysis of DFAT financial expenditure data.

Armoured vehicles

3.15 Table 3.1 sets out the deliverables for the armoured vehicle project defined by the department in its project plan.

Table 3.1: DFAT’s armoured vehicle project plan

Source: ANAO analysis of DFAT’s project plan.

3.16 With respect to the first line of effort, the project plan did not define how many vehicles DFAT was seeking to replace through the project, nor the number of drivers it was seeking to provide with training. DFAT completed an ‘assessment’ of its armoured vehicle fleet in 2020–21 to gather information on the existing fleet of armoured vehicles. In February 2026, DFAT advised the ANAO that the results of this review informed the prioritisation of the procurement of vehicles in March 2021.

3.17 DFAT engaged a supplier in March 2020 to assist with improvements to its armoured vehicle governance. This included review of armoured vehicle specifications, assistance with development of an armoured vehicle lifecycle framework and development of an armoured vehicle manual document to manage the armoured vehicle fleet requirements from definition through to disposal.

3.18 Table 3.2 illustrates that with respect to the second line of effort, there were delays in the engagement of the service provider for management of the armoured vehicle fleet and transition to the new fleet management model. For example, the contract with the new supplier²³ was signed in July 2022, 14 months later than planned. The transition to the new management model occurred in March 2023, 21 months later than planned.

3.19 ANAO analysis of DFAT’s procurement process indicates that this was a result of longer than planned evaluation and contract negotiation phase with DFAT’s preferred tenderer and an extended transition-in phase. During the transition-in phase, the contractor sought amendments to the scope of work through a contract change proposal, delaying submission of its first deliverable (the transition in plan) until 25 November 2022.

Table 3.2: Milestones and achieved dates

Note a: Advice to the ANAO from DFAT in February 2026 was that replacement vehicles were delivered to posts from February 2022 to October 2023.

Source: ANAO analysis of DFAT records.

3.20 Between January 2019 and June 2025 the department spent $19,736,676 on the armoured vehicle project. This was four per cent less than the amount allocated by Australian Government to the program.

What benefits have been demonstrably obtained from the security infrastructure projects?

Security assets and infrastructure upgrades

3.21 DFAT’s analysis indicated that, as of 30 June 2024, it had completed all its metrics associated with the security asset and infrastructure upgrade project. It also reported that it exceeded the number of posts it intended to upgrade security infrastructure to (baseline was 55 posts).

3.22 The ANAO could not verify that the posts had received the upgrades set out in DFAT’s benefits reporting.²⁴ For example, evidence of commissioning of EACS and CCTV systems was not centrally recorded. Data drawn from the Security Equipment and Measures System (SEMS) was unreliable and did not reflect that all upgrades had taken place. For example, the installation date of nine of 63 CCTV upgrades in DFAT’s benefits analysis were consistent with SEMS data. Twenty-six records of CCTV at upgraded posts did not include an installation date and 28 records of CCTV at upgraded posts contained different installation dates to those reported in the benefits analysis.²⁵

3.23 The ANAO undertook fieldwork at three international posts to examine the implementation of SEP upgrades. The ANAO identified operational issues with the implementation and maintenance of security measures at these posts not captured within the department’s benefits realisation reporting.

3.24 Measures examined by the ANAO at post included:

• Public screening measures, including X-Ray machines and Walk Through Metal Detectors;
• Video surveillance systems;
• Access control systems; and
• Security alarm systems.

Public screening

3.25 DFAT established a deed of standing offer with a provider of public screening equipment in January 2021 for the installation of new equipment, equipment support and training. DFAT reporting indicates it used this standing offer to replace X-Ray machines at 52 posts, walk through metal detectors at 37 posts, trace devices at 12 posts, explosive detection devices at two posts and Powdersafes at two posts. DFAT advised the ANAO in February 2026 that prioritisation was ‘based on a combination of asset end of life data in SAP (where available) and RSO verification that equipment needed replacing based on their assessment of local security risks.’

3.26 The ANAO examined the implementation of SEP replacements/installations of public screening equipment at two posts and pre-existing public screening equipment at one post. Some weaknesses were identified with existing equipment which the ANAO brought to the attention of the department.

3.27 Regular operator functionality/calibration tests of equipment are recommended by the manufacturer of public screening equipment. Routine calibration tests could be undertaken by overseas posts to quickly identify when calibration is required.

Video surveillance systems

3.28 DFAT has installed new CCTV at 63 chanceries and 44 staff residences (largely, the Head of Mission residence) between January 2019 and June 2025. DFAT selected a single manufacturer of CCTV systems in 2019 to be installed globally. DFAT developed its CCTV specification and approved product list based on recommendations of an expert it engaged through a competitive procurement process in February 2020 (refer to paragraphs 4.24 to 4.26 for further discussion).

3.29 The ANAO examined the implementation of SEP upgrades or replacements of CCTV at three overseas posts. The ANAO identified weaknesses with the design and implementation of CCTV cameras at these posts which the ANAO brought to the attention of the department.

Electronic Access Control Systems

3.30 The purpose of an Electronic Access Control System (EACS) is to restrict access to designated areas to only authorised persons. Management and maintenance of EACS are vital to ensure optimum performance and a well-functioning system. Regular monitoring of EACS will allow post to identify security culture areas of improvement, security incidents and potential system maintenance requirements. The ANAO identified weaknesses with the implementation, operation and use of EACS for monitoring purposes at the posts visited, and brought these to the attention of the department.

Type 1A alarms

3.31 The Type 1A security alarm system transition policy was released on 12 March 2015, with an update issued 4 September 2017. The policy notes that any existing Type 1 panel may be used until 1 August 2021 and were to use only Type 1A panels from 1 August 2021. As noted at paragraph 1.21, during program delivery DFAT reduced the target number of Type 1A alarms it planned to install. DFAT did not meet this transition date, with the department advising the ANAO in February 2026 that the delay was due to COVID-19 border closures.

3.32 Annual protective security reporting provides assurance to government that entities are complying with their security obligations, implementing sound and responsible protective security practices and identifying and mitigating security risks and vulnerabilities. In its 2024–25 PSPF Report, DFAT reported that it had ‘fully implemented’ requirement 0208 of the PSPF (unauthorised access to security zones one to five is controlled in accordance with physical security measures in accordance with the physical security measures and controls for security alarm systems).

Training

3.33 Advice from DFAT to the ANAO in January 2026 acknowledged the need for improvements to staff training in light of the findings of the ANAO’s visits to posts.

Maintenance

3.35 Preventative maintenance of security measures is critical to ensure the measures are available to posts and operating effectively. Security measures that are faulty or not operating as intended increase the vulnerability of overseas posts. As discussed at paragraph 3.3, a finding of the previous Auditor-General report was that security measures were not being effectively maintained in all cases.²⁶

3.36 The responsibility for maintenance of security assets is split between the Overseas Property Office, Information Management Division, Diplomatic Security Division (DSD) and overseas posts depending on the location of the asset at post. A minute seeking approval for roles and responsibilities of security measures in May 2023 set out that:

Currently, DFAT does not have a shared understanding of the management for security measures through their entire lifecycle. This creates confusion and a lack of accountability across the department and posts, domestically and overseas, resulting in delays in issue resolution.

Neither OPO, Post nor DSD have the operating budget currently needed to support the ongoing maintenance of all security measures which increases the risk of measures failing or becoming ineffectual in reducing the risk of the threats they are installed to mitigate.

3.37 A matrix defining the roles and responsibilities for security measures was to ‘represent a normal baseline for managing security measures’ and endorsed by DFAT Senior Executives in May 2023.

3.38 The security asset policy sets out that it is the ‘responsibility of posts and work areas to fund routine repairs and maintenance from operating funds.’ This includes systems in the public and controlled area at posts such as CCTV and EACS. DFAT has policies in place about EACS and CCTV which specify, for example, that posts should obtain quotes for security asset maintenance during the procurement phase. The specifications do not mandate preventative maintenance or stipulate how often preventative maintenance should be conducted outside a defects liability period.

3.39 Maintenance for some security assets, such as public screening equipment, is managed centrally by the Diplomatic Security Division. Arrangements for provision of public screening equipment include maintenance. While the Deed of Standing Offer specifies that maintenance of equipment should be as per the ‘original equipment manufacturer’ instructions, DFAT advice from November 2025 indicates that it was not making use of the full range of support services from the public screening provider. DFAT advice indicated that, for example, it considered walk through metal detector maintenance as ‘excluded maintenance’ because they are ‘considered to have a low risk of failure and are designed to be “set and forget” units.” In contrast, the installation, use and maintenance guide from the manufacturer indicates that technical level functionality testing should occur every six to 12 months and verification of the calibration should occur every 12 months. ANAO’s testing from international fieldwork indicates that there were vulnerabilities with existing metal detectors that were not identified by the department’s approach.

3.40 There are shortcomings in the quality of data regarding maintenance of security assets maintained by overseas posts (refer to paragraph 4.50). This reduces the oversight DSD has as to whether posts’ security measures are fit for purpose and appropriately mitigating security risks. For example, there is limited data on whether posts have security asset maintenance contracts in place and how often maintenance of these assets is occurring. DFAT was not aware of some issues identified with equipment and issues with equipment were not factored into posts’ assessment of the effectiveness of existing risk controls.

3.41 Preventative maintenance was not included in costings for SEP Tranche 1 (refer to Figure 1.1) meaning that the operating costs of newly acquired and installed equipment was required to be absorbed by DFAT. A lesson learned, highlighted in the project closure report, was ‘capturing whole of life costs at the time of the New Policy Proposal submission to avoid sustainment challenges at completion of the project.’

3.42 While DFAT decided to absorb some sustainment costs, there have been gaps in the ongoing sustainment of newly installed security assets. For example, instructions from manufacturers indicate that twice yearly preventative maintenance of Type 1A alarms should occur. While DFAT commenced installing Type 1A alarms from December 2019, the first preventative maintenance visits for these assets occurred in December 2024 (a gap of around five years).

3.43 DFAT secured some funding to maintain these security assets as part of the 2024–25 Hardening the Diplomatic Network measure. DFAT advised the ANAO in February 2026 that ‘it notes that while manufacturers indicate that preventative maintenance must occur every 6 months, DFAT is not resourced or funded to achieve this given its global footprint.’ Further advice from the department was that:

DFAT does not consider that preventative maintenance strictly in accordance with manufacturers’ instructions is feasible … across all posts — resource intensive. DFAT will apply a risk-based approach to preventative maintenance, informed by manufacturer guidance but adapted to operational, environmental and resourcing considerations.

Armoured vehicles

3.45 DFAT reported that, as of June 2024, it had completed both metrics related to the armoured vehicles (number of vehicles replaced/upgraded and the number of qualified drivers).

3.46 ANAO analysis indicates that the metrics for this project were incomplete, not covering a key deliverable of the project: transition management of the fleet to an outsourced provider. While the department engaged a provider in July 2022, it decided in February 2025 not to exercise contractual options to extend the service provider contract beyond the initial three-year term. This was due to what was described by the department as significant issues that started from the time contract was signed. The issues identified included ‘unprofessional conduct, lack of experience in delivering contract outcomes, CAV quality issues due to poor choice of sub-contractors and poor business administration.’

3.47 Following a decision to end the service provider contract from 1 July 2025, the department opted to build an in-house capability. The objectives of this in-house capability were to expand Armoured Vehicle governance policy, framework, and procedures; implement a fully resourced and qualified workforce to acquire and manage the Armoured Vehicles; establish an Armoured Vehicle Fleet Management Program; and strengthen the Armoured Vehicle acquisition process.

3.48 DFAT’s benefits tracking indicated that, by 30 June 2024 it had delivered 81 upgrades to armoured vehicles or replacements comprised of four seat replacements, 15 mechanical repairs, 25 completed builds, 20 vehicle moves and six vehicle disposals. DFAT also reported that there were 14 builds ‘in progress’ and five vehicle moves in progress. It is not clear how measurement of movements, sale, gifting and disposals of armoured vehicles contributed to enhanced mitigation capabilities The department did not measure the number of vehicles accepted into service.

3.49 DFAT’s transition to service report for the armoured vehicles capability noted that there were multiple procurement approaches to source armoured vehicles. For example, prior to the fleet management provider being procured, DFAT ordered armoured vehicles through an existing standing offer arrangement. Vehicles were also sourced from the fleet management service provider following contract signature in July 2022.

3.50 The ANAO was unable to verify the number of vehicle upgrades or enhancements because of the state of DFAT’s data. For example:

• Prior to its international fieldwork to one location, the ANAO analysed the Security Equipment and Measures (SEMS) data which indicated that five of nine armoured vehicles were past their end-of-life date. DFAT advised the ANAO that the data was not accurate (that is, did not reflect that five new vehicles had been delivered to post) and updated the status of the armoured vehicles in Security Equipment and Measures System.
• According to the invoices paid, DFAT ordered thirty armoured vehicles from the service provider before contract expiration. Twelve of the vehicles ordered were not recorded in the Security Equipment and Measures System database.

3.51 DFAT’s transition to service report also set out another outstanding deliverable was the establishment of an online application where vehicle data was stored and provided easy access to reporting on the fleet and its status. This was part of the contract between the service provider and DFAT to provide a system to capture and supply details of the department’s armoured vehicles and support its delivery of the services. The system was to capture the supplier’s details (such as CAV acquisition value, make and model etc.), maintenance, disposals, details of any leased armoured vehicles and historical transactions.

3.52 DFAT’s armoured vehicles fleet database was identified as part of the transition out deliverables to be delivered by the service provider before 30 June 2025. DFAT advised the ANAO in February 2026 that the service provider ‘did not provide the requested data or CAV database; this resulted in a reduction of the monthly management fee … DFAT has developed a fleet management tool that collects driver and vehicle data.’

4.1 Security monitoring and assurance arrangements provide structure to ensure departmental security arrangements are effective and efficient in protecting people, information and assets. The Australian Government has made investments on three occasions to improve DFAT’s security monitoring and assurance. This included monitoring projects under the SEP and a project under the Hardening the Diplomatic Network measure to increase the number of technical security inspections.

What were the expected benefits from the security monitoring projects?

4.2 Policies under the DFAT Security Framework set out its core assurance requirements. For example, each overseas post is required to conduct an annual self-assessment of the condition of security infrastructure, assets, features and equipment (Post Security Health Check), an annual assessment of the effectiveness of security measures (security risk assessment) and to update a post security plan which details relevant security information, instructions and procedures for each post. DFAT also performs inspections of overseas posts to assess its security vulnerabilities and the effectiveness of its security measures.

4.3 A previous Auditor-General report found that while DFAT had in place monitoring and reporting on security at overseas posts, the effectiveness of these arrangements was limited as the arrangements were not consistently implemented or verified. This reduced the assurance provided by these arrangements that security at overseas posts was effectively mitigating risks. The Auditor-General recommended that:

• Recommendation 2: DFAT develop and maintain a comprehensive database of physical and operational security measures at overseas posts
• Recommendation 5: DFAT refine a framework for risk-based selection of posts for security inspection, improve the deployment of inspection staff resources, and develop consistent standards and accountability mechanisms to enable the timely identification and resolution of security vulnerabilities at posts.
• Recommendation 7: DFAT develop an information system to respond to security breaches, and identify trends and mitigation strategies, based on reliable and useful breach data.²⁷

Security enhancements program

4.4 There were three security monitoring projects which contributed to the realisation of eight benefits across SEP. These included:

• An increase to the number of Regional Security Officers (RSOs) and Regional Technical Engineers (RTEs) (Project B) to mitigate security risks by improving the availability of timely specialist security advice at overseas posts.
• Delivering a database and workflow capability to manage DFAT’s security information and security requests (Project D). The intended benefits from this project were to provide DFAT with greater visibility of the security measures in place to mitigate security risks and to support improved asset management.
• Establishing a Global Security Operations Centre (GSOC) to monitor and respond to cyber and physical security incidents from a centralised location (Project E). This project was intended to enhance detection of malicious threats and improve information and communication technology (ICT) security capability.

4.5 The department set out a total of 16 metrics contributing to the realisation of the eight program benefits, which are set out in Figure 4.1. As of June 2024, DFAT reported that 12 metrics were completed and four were in progress. All metrics for the RSOs and RTEs were finalised, two of five metrics completed for the assets database and four of five metrics completed for GSOC.

Figure 4.1: DFAT benefits realisation reporting on monitoring projects

Source: ANAO analysis of DFAT records.

4.6 As discussed at paragraph 1.21, the department’s baseline for the measurement of program benefits for the monitoring projects changed during the program.

4.7 In addition to achieving benefits, the monitoring projects formed part of the department’s response to implementing Recommendation 2 from the 2017 Auditor-General report (see paragraph 4.3).

Hardening the diplomatic network technical inspections

4.8 DFAT was provided with funding through the 2024–25 Federal Budget to increase the number of technical security inspections per year. As set out in Figure 4.2, the department defined one benefit in relation to this project ‘risk reduction due to an increase in the number of staff with technical security inspections skillsets and the frequency of technical inspections.’ There were three outcomes related to this benefit and six metrics associated with the realisation of the expected outcomes.

Figure 4.2: Technical inspections benefit profile

Source: ANAO analysis of DFAT documents.

Were the activities to realise the benefits effectively delivered, including on time and within budget?

4.9 Table 4.1 indicates the overall delivery status of each of the SEP projects in terms of scope, time and budget.

Table 4.1: Overall assessment of activity delivery

Source: ANAO analysis of DFAT records.

Regional Security Officers and Regional Technical Engineers

4.10 There were no project milestones set out in the project planning documentation for Project B.

4.11 All RSO positions had been filled by the time DFAT closed SEP in December 2023. Those positions remained filled as of January 2026, with 31 RSOs providing specialist security advice.

4.12 Two regional technical engineers were not recruited as originally planned. These roles were converted to additional RSO positions (refer to paragraph 4.38 for further discussion).

4.13 There was a significant underspend of project funds. Whereas the allocation of budget to the project at the government approval stage was $40,444,124, expenditure on the project between January 2019 and June 2023 was less than half, at $18,994,058. DFAT’s project closure documentation indicates that this underspend was ‘due to COVID-19 and travel restrictions. Funding was redirected to cyber capabilities as they could be delivered domestically.’

Security Equipment and Measures System (SEMS)

4.14 The department’s approach to develop a security asset management database was to define its requirements and approach the market to procure a Software as a Service delivery partner.

4.15 The department met its planned timeframe for the development of the requirements (December 2019).

4.16 There were delays associated with the procurement of a delivery partner. The initial completion of the procurement phase of the project was delayed from June 2020 to September 2021. The Request for Tender closed on 30 April 2020 and the department had selected preferred tenderers by 6 November 2020. The department entered a period of extended contract negotiations between November 2020 and August 2021, whereby it updated its evaluation of the technical suitability of the two preferred tenderers following its identification of its reduced capacity to host an asset management system and ‘clarification’ of matters within both preferred tenderers’ bids. A contract was signed in September 2021.

4.17 Delays continued throughout the delivery phase of the contract. For example, the initial project plan for SEMS anticipated that the minimum viable product would be completed by 30 December 2020. The minimum viable product was accepted by the department in February 2023 (26 months later than initially planned). The acceptance certificate listed nine defects or non-conformances to be resolved prior to Diplomatic Security Division (DSD) launch and an additional twelve defects or non-conformances to be resolved prior to global launch.

4.18 The date for SEMS full rollout was anticipated by the department in its initial project plan as 30 June 2021. The system was launched globally over two years later than planned in November 2023. The department attributed these delays in its project closure report to poor supplier performance, diversion of SEP resources to address issues resulting from supplier underperformance and ‘DSD’s lack of ownership … which manifested in the appointment of a SEP project team contractor as the proxy product owner.’ DFAT did not receive the full functionality of the asset management system as contracted, with some requirements in the contract not being delivered as of February 2026 (for example, refer to paragraph 4.48).

4.19 As set out in Table 4.2, expenditure of $8.3 million exceeded budgeted estimates, both in the costing process and initial project planning stage. Total expenditure on this project was 43 per cent higher than the initial allocation and 93 per cent higher than the initial project planning estimate.

Table 4.2: Planned and actual expenses on Security Equipment Measures System (Project D)

Note a: Total expenditure between 1 January 2019 to 30 June 2023. This does not include any ongoing sustainment costs from 1 July 2023 or additional expenses related to enhancements.

Source: ANAO analysis of DFAT financial data.

4.20 The total expenditure reflects, in part, that the department did not appropriately manage financial risks first identified with the submission from the successful tenderer during the evaluation process for the Request for Tender in November 2020. For example, during the financial evaluation the department identified that the proposal ‘to enter into a fixed price contract prior to detailed discovery being done presents a high risk that costs would increase following contract signing’. The approved value of the contract had increased from $1.3 million to $8.4 million as of January 2026.

Global Security Operations Centre

4.21 The Global Security Operations Centre (GSOC) project was to be delivered in three phases.

• In the first phase, DFAT planned to centralise and enhance components of existing capability into a centralised monitoring location.
• In the second phase, DFAT planned to integrate Type 1A alarms, access logs and CCTV, and introduce new network monitoring capabilities as delivered through the Mitigating the Insider Threat project (Project F).
• In phase three, the project plan expressed that it would deliver ‘further improvements to be identified as both the capability and technology matures.’

4.22 DFAT’s closure report for the program noted that ‘the project would have benefited from an initial requirement gathering phase to better define the work required to meet objectives.’ Poor requirements definition resulted in packages of work being moved into successive phases of the project. For example, the GSOC incident response plan was endorsed in September 2025, 4.5 years later than anticipated.

4.23 Expenditure on the GSOC was $12,318,580. This was 76 per cent higher than the amount allocated at the government approval stage of $7 million. DFAT’s project closure report indicates that ‘IMD engaged a vendor business partner during the life of the New Policy Proposal to expedite DFAT’s cyber capability upskilling …’, leading to higher expenditure on this project than planned. Table 4.3 sets out key GSOC deliverables across the projects’ three phases, the status of these deliverables at program closure and the delivery status as of January 2026. It indicates that at project closure there was a considerable portion of work outstanding for the project related to physical security monitoring.

Table 4.3: GSOC deliverables

Key: ◆ delivered ▲ partly delivered ■ not delivered

Source: ANAO analysis of DFAT records.

CCTV monitoring

4.24 The initial project plan for the GSOC set out that the scheduled date for CCTV footage being available in the GSOC was 8 July 2020. Planning for this capability commenced early in the program. DFAT released a Request for Tender in November 2019 for provision of a video surveillance capability, which included ‘implementation of a Global CCTV system into production using one post, transmission solution and the Canberra subsystem.’²⁸ Following a competitive tender process, in February 2020 DFAT signed a contract to complete this scope of work.

4.25 Some key deliverables of the contract were met. This included a detailed design for the network architecture, an approved product list and testing of the proposed solution in Canberra delivered and accepted by the department. The initial testing of the system indicated that the proposed solution may not be ‘a viable option’ and ‘robust controls will need to be put in place or remote capabilities blocked …’ DFAT advised the ANAO in November 2025 that the results of the testing:

indicated DFAT lacked the necessary IT network infrastructure to support this initiative from a cybersecurity standpoint. DFAT assessed that the cost for bandwidth to bring the data back to a central point in Canberra was cost prohibitive.

4.26 DFAT did not undertake installation at a pilot post nor did it obtain advice on the implementation of a global support model. Installations of the recommended CCTV commenced in February 2020 through the security infrastructure upgrades project (refer to paragraph 3.28), without a plan in place for connectivity of the CCTV to a centralised monitoring location. DFAT advised the ANAO in February 2026 that at the time CCTV installations commenced, there was no viable or compliant option to support centralised monitoring or a global support model.

4.27 Requirements for CCTV connectivity were developed by the department in 2023. By June 2023, a CCTV solution had been ‘conditionally approved’ by the department’s Architecture Review Board (ARB). The ARB did not grant an interim approval to operate as this was dependent on costings being approved for a proof-of-concept phase.

4.28 DFAT advised the ANAO in February 2026 that:

while it would want this capability, there are no plans to transmit CCTV video feeds back to Australia due to the high costs of international bandwidth costs. Currently, the use of in country internet service providers and satellite communications is significantly more affordable. Additionally, the PSPF does not allow government entities to host sensitive data in commercial cloud environments located offshore. DFAT anticipates that this could be revisited in 2-3 years depending on advancements in satellite technology.

GSOC documentation

4.29 The GSOC deliverables included supporting documentation such as an incident response plan, training plan and standard operating procedures. The Phase Two and Phase Three GSOC Operationalisation plans included deadlines of August 2020 and August 2021 for development of an incident response plan respectively. There were no other deadlines defined for other GSOC documentation such as training plans and standard operating procedures.

4.30 A contract was established in February 2020, following a competitive tender process. The contractor was to deliver governance documentation for the GSOC including an incident response plan, playbooks and standard operating procedures, a knowledgebase, training manual, operational structure, roles and responsibilities, reporting requirements and metrics, reports and dashboards.

4.31 The contractor provided a draft incident response plan (IRP), which was not finalised before the conclusion of its contract. Departmental documentation between officials described some of the issues with the draft, such as not being in the recommended template, law enforcement referral not being regulated and no processes set out for communication with external entities. In February 2026, DFAT advised the ANAO that due to issues with the contractor the Incident Response Plan was completed by DFAT (in-house) and has been subsequently updated.

4.32 As part of the GSOC Phase 3 plan, the department identified other GSOC documentation it considered as part of the phase 3 deliverables such as a personnel security framework and building on training and resources delivered in the first two phases. In November 2022, DFAT received approval to approach the market to run a panel procurement to source a new contractor to deliver the requirements for an incident response case management system, operating model and Hunt Framework. While the RFQ documents were released to market, DFAT records indicate that the tender validity period expired before submissions were considered or evaluated. Other governance documentation was completed by DFAT following closure of SEP, such as the GSOC Cyber Threat Framework in August 2025.

Technical security

4.33 Most key deliverables for this project were scheduled to be completed by 30 June 2025 (refer to Figure 4.1). As set out in Table 4.4, DFAT completed one of the project milestones on time and one milestone later than planned. Other milestones, such as training of officers and completion of policy documents remains ongoing.

Table 4.4: Technical security project deliverables and status

Source: ANAO analysis of DFAT records.

4.34 The total budget for the technical security projects between July 2024 and June 2028 is $8 million. This is comprised of $1.8 million in capital expenses and $6.2 million in operating expenses. Between July 2024 and June 2025, DFAT spent $2.8 million. DFAT advised the ANAO in May 2026 that it is ‘forecast to fully expend the remaining $5.2 m operating budget to June 2028.’

What benefits have been demonstrably obtained from the security monitoring projects?

Regional Security Officers and Regional Technical Engineers

4.35 DFAT reported that all seven metrics related to the realisation of the benefits from the Regional Security Officers (RSO) project had been realised as of June 2024. ANAO analysis of DFAT records indicates that five of seven metrics were achieved.

4.36 The number of posted RSOs increased from 15 in 2017 to 31 as of January 2026.

4.37 DFAT adopted an approach where each RSO is responsible for multiple posts within a specified geographic zone. All DFAT posts have access to specialist security advice through a posted RSO.

4.38 DFAT reported that the two metrics related to the deployment of Regional Technical Engineers had been completed as of June 2024. ANAO analysis indicates that this capability was cancelled. DFAT’s benefits reporting did not reflect that recruitment of Regional Technical Engineers was ceased in July 2020, following the department’s consultation with other government agencies and assessment that the ‘RTE role is not a viable option within DSD’. DFAT instead agreed to re-prioritise the funding two recruit an additional two RSOs.

4.39 DFAT advised the ANAO in January 2026 that:

DSD reviews RSO posting location, level and skillset every posting cycle to adapt to changing threat and risk profiles and ensure the best utilisation of minimal posted security resources globally. These two roles have been changed to RSO since SEP due to:

• lack of requirement in [removed] for specialist technical skills, availability of specialist technical security officers, priority for generalist security skills and availability of regional technical officers
• inability to identify a staff member to deploy as an RTE to [removed]. As an alternative, a RSO with specific security skills appropriate to the threat and risk environment has been deployed.

4.40 While DFAT has increased the number of RSOs, their roles and responsibilities are not clearly defined in the Departmental Security Framework, unlike other security personnel.

4.41 Some RSO tasks are set out in the departmental security framework. For example, an important function of RSOs include undertaking post security inspections. The purpose of post security inspections is to assess the appropriateness, effectiveness, utility and efficiency of all aspects of protective security. Some vulnerabilities identified by the ANAO during its international fieldwork to three overseas posts were not identified during recent RSO inspections. ANAO analysis also indicates that DFAT is not meeting its internal security inspections policy that all posts have a security inspection performed at least once every three years.

4.42 Updates to the DFAT security framework, adhering to the departmental security inspections policy and more consistent recording of post security inspections in a centralised database would enable DFAT to fully realise the intended benefits and strengthen its monitoring of security arrangements overseas.

Security Equipment and Management System

4.44 As of June 2024, DFAT reported that the benefits from the Security Equipment and Measures System (SEMS) project had been partly realised. Implementation of three of five metrics related to Project D was identified as ongoing. These metrics were the number of users, the ability to use the database to support security risk management and using the database to support capital and budget planning processes.

4.45 ANAO analysis of the SEMS database in February 2026 is consistent with DFAT’s closure report which noted a technical solution was delivered at program closure. By May 2023, DFAT had accepted a technical solution minimum viable product²⁹ and SEMS was launched globally in November 2023. As of December 2025, there were 9,535 security measures (such as security assets and operational security measures) recorded in the database across 111 overseas posts.³⁰

4.46 There are known issues with the completeness and accuracy of data in SEMS which affects the ability of DFAT to realise the intended benefits of the database.

• Security data has been recorded for 111 of 118 posts (94 per cent).³¹
• Only those security assets in the public area and controlled area at post (see Figure 3.1) are recorded in the database.

4.47 Data in SEMS may differ to information in DFAT’s financial management information system: SAP. One of the ‘desirable’ requirements listed in the Request for Tender for OurSecurity was for integration with SAP asset management including: asset serial numbers, SAP asset numbers, asset makes and models, location information and financial end of life. This requirement was reflected as part of the contract signed in September 2021. As of January 2026, there was no integration between SAP and SEMS. Of the 9535 measures recorded at overseas posts, 2005 (21 per cent) had a SAP asset number included in the measure details as required.³²

4.48 To support security risk assessment and assessment of whether mitigations in place are appropriate for the security risk level, the DFAT Security Framework sets out that Post Security Officers must maintain in OurSecurity a register of all security measures. SEMS is ‘maintained by posts … The accurate, timely and complete logging of data in the Measures Data is critical …’ ANAO analysis of DFAT data indicates’ logging of measures has not been accurate or timely. For example, as of December 2025, 5931 of the 9535 measures recorded in the database have not been updated since December 2023 (62 per cent).

4.49 Other issues with the accuracy of data observed by the ANAO include:

• Inconsistent approaches to recording security measures information. For example, in some locations ‘CCTV system’ is recorded as a single entry whereas in other locations each camera is recorded as a separate entry, including the precise location of the camera.
• Inconsistent or inaccurately recorded installation dates, meaning that the end of life for security assets cannot be accurately estimated using this data. For example, 2414 of the 9535 security measures recorded (25 per cent) in the database for overseas posts have no installation date recorded, including new assets installed as part of Project A.
• There is a lack of meaningful information on maintenance of assets at overseas posts. For example, maintenance for 8657 measures overseas is listed as ‘based on review’ (91 per cent of overseas measures).

4.50 As of December 2025, the department received additional funding through the Hardening the Diplomatic Network budget measure to improve the completeness and accuracy of the data.

GSOC

4.52 DFAT’s benefits realisation reporting from June 2024 sets out that four of five program metrics for GSOC have been completed, and one metric remains in progress.

4.53 The ANAO’s analysis of DFAT’s benefits realisation for the GSOC is consistent with DFAT’s, except for the CCTV surveillance capability.³³ While the benefits tracker lists this capability as ‘cancelled by the Program Board’, the closure report for the program sets out that work on this concept would continue post program closure.

4.54 DFAT’s initial project plan for the GSOC identified that a key objective was to ‘view CCTV footage that relates to an alarm or other security event at post (on an ad hoc basis and as required).’ DFAT subsequently approached the market and selected CCTV technology to assist it in implementing this objective, which has been implemented through the security infrastructure and assets project.

4.55 The ANAO raised with DFAT opportunities for it to make greater use of video surveillance systems.

Technical security

4.57 Realisation of the project benefits for the technical security project remains ongoing. In addition, the department has not been adhering to its own policy regarding the conduct of technical inspections. The ANAO raised with the department the opportunity to implement a risk-based approach within the overarching framework of its existing policy.

Appendix 1 Entity response

Appendix 2 Improvements observed by the ANAO

1. The existence of independent external audit, and the accompanying potential for scrutiny improves performance. Improvements in administrative and management practices usually occur: in anticipation of ANAO audit activity; during an audit engagement; as interim findings are made; and/or after the audit has been completed and formal findings are communicated.

2. The Joint Committee of Public Accounts and Audit (JCPAA) has encouraged the ANAO to consider ways in which the ANAO could capture and describe some of these impacts. The ANAO’s corporate plan states that the ANAO’s annual performance statements will provide a narrative that will consider, amongst other matters, analysis of key improvements made by entities during a performance audit process based on information included in tabled performance audit reports.

3. Performance audits involve close engagement between the ANAO and the audited entity as well as other stakeholders involved in the program or activity being audited. Throughout the audit engagement, the ANAO outlines to the entity the preliminary audit findings, conclusions and potential audit recommendations. This ensures that final recommendations are appropriately targeted and encourages entities to take early remedial action on any identified matters during the course of an audit. Remedial actions entities may take during the audit include:

• strengthening governance arrangements;
• introducing or revising policies, strategies, guidelines or administrative processes; and
• initiating reviews or investigations.

4. During the course of the audit, the ANAO did not observe changes in DFAT’s approach to SEP benefits realisation.

Appendix 3 Projects delivered under the Security Enhancements Program

Source: ANAO analysis of DFAT documents.

Appendix 4 Relationship between SEP Projects and Benefits

Appendix 4 Relationship between SEP Projects and Benefits

Source: DFAT’s benefits realisation plan.