2025 Auditor General Report: Cyber Security Of Government Networks And Systems

Cyber Security of Government Networks and Systems Audit (2025)

The Auditor General concluded that while the federal government has developed strong cybersecurity tools and a new enterprise strategy, Canada’s defences remain fragmented, reactive, and incomplete. Major gaps in monitoring, coordination, and information sharing have left federal systems vulnerable to sophisticated attacks that threaten Canadians’ personal data and critical public services.

More than half of federal organizations still operate outside the core protection network, and key modernization projects, including the Security Information and Event Management (SIEM) system and Endpoint Visibility initiative, are years behind schedule.

The report warns that without unified cyber defences, up-to-date asset inventories, and faster response coordination, the government’s ability to prevent or contain large-scale breaches will remain severely limited. Although new leadership commitments and strategies are in place, real resilience will depend on accelerating implementation and ensuring every department is fully integrated into a common defence framework.

Key Facts

The Treasury Board Secretariat (TBS), Communications Security Establishment (CSE), and Shared Services Canada (SSC) share responsibility for defending federal systems from cyber threats.
From April 2023 to March 2024, CSE’s sensors blocked 2.4 trillion suspicious cyber events; SSC’s Enterprise Internet Service blocked 6.6 trillion.
Despite these defences, federal coordination failed during major incidents in January and March 2024, allowing attackers prolonged access to sensitive data.
119 federal organizations (58% of total) are not required to use CSE and SSC’s cybersecurity services, leaving major coverage gaps.
SSC’s Security Information and Event Management (SIEM) project and Endpoint Visibility, Awareness, and Security (EVAS) project, key to monitoring and asset tracking, remain unfinished, delaying modernization.

Key Findings

1. Strategy in Place but Implementation Lagging

The new Enterprise Cyber Security Strategy is comprehensive, addressing risk identification, vulnerability management, stronger defences, and workforce skills.
However, many initiatives are in early stages, few have defined outcomes or timelines.

2. Inconsistent Use of Cybersecurity Services

Only 85 of 204 federal entities are required to use SSC’s secure network and CSE’s sensors; the rest may opt in voluntarily.
Of those not required, 80% did not use SSC’s Enterprise Internet Service, and 36% did not use CSE’s sensors, creating blind spots.
Some Crown corporations refused participation citing independence concerns or difficulty tailoring federal services to their systems.
The result: fragmented protection, uneven detection, and reduced ability for the government to identify coordinated attacks.

3. Gaps in Cyber Monitoring and Response

SSC’s SIEM project (launched 2017, cost rising from $72.7M → $144M) was suspended in June 2024 pending funding.
Without SIEM, the government cannot monitor all suspicious activity across networks.
CSE spends about $17 million annually analyzing limited data, with costs rising and resource shortages projected.

4. Incomplete IT Asset Inventories

Neither SSC nor CSE maintains a complete inventory of all government devices or networks.
The EVAS project, launched in 2017 with a $175M budget, remains unfinished and delayed until 2027.
Missing inventories mean uncertainty about which systems need patches or upgrades, leaving unknown vulnerabilities unaddressed.
TBS’s 2024 Security Directive requires the 85 major departments to confirm deployment of defence sensors on all devices by November 2024, still ongoing at audit’s end.

5. Poor Coordination During Cyber Attacks

Coordination failures were documented during major breaches (e.g., Global Affairs, FINTRAC, and others).
In one case, it took seven days to share critical data between SSC and CSE, giving hackers more time inside federal networks.
No central collaboration or case management tool exists for incident response; this hampers rapid containment.
CSE has proposed such a platform but, as of audit completion, had no timeline or funding approval.

Recommendations and Timelines

Recommendation	Lead	Timeline / Commitment
Restart and complete SIEM project with clear criteria and timeline	SSC (with CSE)	Procurement and contracting authorities by Dec 2025
Develop full IT asset inventory and fix EVAS project delays	SSC	Materiel management modernization by Mar 2028; EVAS contract by end of 2025
Ensure all federal organizations install defence sensors and patch vulnerabilities	TBS & CSE	Ongoing through 2026, tied to Enterprise Cyber Strategy rollout
Improve incident coordination and response protocols	TBS, SSC, CSE	Cyber simulation exercise and updated Event Management Plan by March 2026
Develop and implement national cyber collaboration platform	CSE	Funding request in progress; timeline TBD pending approval

Overall Conclusion

The Auditor General concluded that while strong cybersecurity tools exist, their inconsistent use, poor coordination, and incomplete implementation weaken Canada’s cyber defence.

The government is not yet equipped to detect or respond rapidly to sophisticated attacks.
Over half of federal entities operate outside the main defence network, exposing gaps in protection and monitoring.
Projects vital to Canada’s cyber readiness, including SIEM and EVAS, are years behind schedule.
Without unified systems and shared data, the federal government remains vulnerable to breaches that could disrupt essential services and compromise citizens’ personal information.