The Australian Bureau of Statistics has engaged outside cyber security specialists for a broader IT hardening program ahead of the 2026 Census main event on August 11.

The work was revealed in an audit of the bureau’s cyber readiness for the census.

According to the audit report, the program is being “executed in three consecutive, two-month tranches of work” and covers more than the immediate census technology stack.

Wider ABS environment brought into scope

The audit report said the “systems hardening program encompasses a large scope of work across the broader ABS ICT environment”.

It added that ABS had allocated extra resources to deliver the hardening in time for the census and was proceeding under a prioritised schedule of activities.

In January 2026, ABS engaged specialists to “uplift and harden” its ICT and cyber security environment ahead of the census main event.

The specialists were first expected to work with the bureau for four weeks, but the engagement was extended to between three and six months, the auditor said.

The report also said ABS brought in additional cyber security support from mid-February 2026, after the work required cyber security experts to be deployed for a longer period than originally expected.

Risk review highlighted broader exposure

The program appears to have followed an oversight in which the bureau’s security and de-risking efforts had been more focused on immediate technical components of census systems.

A strategic risk “deep dive” conducted in late 2024 raised the issue.

The auditor said cyber security threats to the 2026 Census across all ABS ICT systems, rather than only systems implemented for the census, were raised in the September 2024 exercise.

That review advised the census executive board that the threat environment extended beyond census systems to ABS IT systems more broadly.

While the review focused mainly on census-managed controls, it also acknowledged the need to secure systems outside the census program.

Census security under scrutiny since 2016

Cyber security protections for the census have remained a key issue since 2016, when census night systems buckled largely because of repeated distributed denial-of-service attacks.

The census now runs on AWS cloud services, with its security subject to close scrutiny and considerable testing ahead of the national count.