Mr. Paul Reid:

The Senator's opening remarks are much appreciated and will be passed on to everybody. Regarding the cyberattack and cost, there are a few aspects for now and the future, as the Senator said. We will incur a number of costs in the short and medium term. As the Senator described, much technical work will have to be carried out on the network and infrastructure. There are capital costs to replace a number of devices across our networks which we believe it would not be best practice to leave on the network with the new controls that we will put in place. There are also capital costs where we will need to and will take the opportunity to upgrade some of our key systems, such as national integrated medical imaging system, NIMIS, our radiology system, to bring them up to a higher standard. Third party costs, as the Senator mentioned, relate to technical expertise that we have engaged including some of the best technical experts from a range of specialist providers that we have engaged in the country. As the Senator rightly said, we have also engaged international expertise, primarily the international organisation in the USA, Mandiant, which is working on the decryption process. It is a world leader in malware and ransomware recovery. It has been working with us since the cyberattack. There are costs across a range of providers.

We will have to incur costs in the future, considering the scale and size of our networks. I worked on networks previously in different organisations. Many organisations have a 24-hour monitoring centre, sometimes called a service operation centre or network operation centre. Due to the scale of the network, we will need to put in place a security operation centre to monitor our network much more comprehensively for 24 hours. We will take the opportunity to update many of our Microsoft applications to Microsoft 365 and a significant cost will be associated with that.