Request for Information - Cyber Security Dashboard

Overview The Queensland Government, through Customer Services, Open Data and Small and Family Business (CDSB), is seeking information from the market to better understand available products, services and delivery approaches that could support an executive-level cyber security dashboard and/or reporting capability. This Request for Information is intended to inform the Queensland Government's understanding of the market and the range of possible approaches available. It is not intended to prescribe a particular technical solution, architecture, product type or delivery model. About The intended capability would provide executive government with a consolidated view of the cyber security position across Queensland Government budget sector agencies, with potential future expansion to include Government Owned Corporations (GOCs) and statutory authorities. The current budget sector comprises approximately 21 agencies/entities, with a broader future scope potentially including statutory authorities, in addition to relevant GOCs. Queensland Government agencies operate in a complex and diverse digital environment, with varying business functions, risk profiles, technology landscapes and levels of cyber security maturity. Cyber security information is often generated through a range of sources, including assessments, assurance activities, operational reporting, incident information, risk reporting and control performance measures. This information may be held in different formats, at different levels of maturity, and with varying degrees of consistency across entities. At present, there is no single, fit-for-purpose executive-level mechanism that consistently aggregates and presents cyber security information across in-scope Queensland Government entities in a way that is sufficiently clear, comparable and decision-useful for executive government. Relevant cyber security information may exist across multiple systems, reporting processes and assessment mechanisms, which can make it difficult to obtain a consolidated whole-of-government view. Differences in data quality, reporting methods, terminology, technical maturity and system capability across entities may also limit the ability to produce consistent and trusted reporting for senior decision-makers. Purpose Executive government requires clear, timely and meaningful insight into the overall cyber security posture of the Queensland Government to support strategic oversight, risk-informed decision-making, prioritisation of investment, and whole-of-government assurance. This includes the ability to understand broad trends, emerging issues, areas of elevated risk, and comparative performance across a diverse operating environment.