ABS runs six-month IT environment hardening before census

The Australian Bureau of Statistics has engaged “significant” outside support to harden its broader IT environment ahead of the national census in mid-August.

The program of work, revealed as part of an audit of the bureau’s cyber readiness for the census, is being “executed in three consecutive, two-month tranches of work,” according to the auditor.

“The systems hardening program encompasses a large scope of work across the broader ABS ICT environment,” the audit report states.

“The ABS has allocated additional resources to deliver systems hardening in time for the 2026 Census and is proceeding according to a prioritised schedule of activities.”

The audit report said the hardening work “has required deployment of significant cyber security experts for an extended period beyond that originally anticipated.”

“In January 2026, the ABS engaged specialists to ‘uplift and harden’ the ICT and cyber security environment ahead of [the] 2026 Census main event”, which is on August 11.

“The team was originally planned to work with the ABS for a four-week period; this was extended to last for between three to six months,” the auditor said.
“In addition, the ABS engaged significant additional cyber security support from mid‑February 2026.”

The program of work is the result of an apparent oversight by the bureau, whose efforts were more focused on the security and de-risking of immediate technical components of census systems.

A risk-related “deep dive” exercise performed for the census in late 2024 highlighted the oversight.

“Cyber security threats to the 2026 Census across all ABS ICT systems, not just systems implemented for the 2026 Census, were raised in the September 2024 strategic risk deep dive,” the auditor said.

The deep-dive advised the census executive board that “the threat landscape … extends beyond census to ABS IT systems. Although the scope of [the deep dive focuses mainly on census-managed controls, this report acknowledges the need to secure not only census systems, but all others.”

Cyber security protections and controls around the census have been a key issue since 2016, when the systems buckled on census night, largely due to repeated distributed denial-of-service attacks.

The census now runs on AWS cloud services, and its security is subjected to heavy scrutiny and considerable testing.