GIW Federal 2025: Securing the supply chain: Managing third-Party risk in government with Rosetta Romano

Strengthening Cyber Resilience in Government Supply Chains: A Presentation by Dr Rosetta Romano

She began by acknowledging Ngunnawal Country, reminding the audience that Lake Burley Griffin—now a symbol of Canberra’s identity—was once the Molonglo River, a gathering place for over 10,000 years. This historical perspective framed her discussion on community protection, shared responsibility, and the systemic impacts of cybersecurity decisions.

Dr Romano’s research focuses on third-party cyber risk, particularly among small and medium enterprises (SMEs) that support government and defence. She explored the increasingly complex landscape of cybersecurity standards:

• Essential Eight, developed by ASD

• DISP accreditation, mandatory for Defence-related work

• ISO 27001, with more than 1,400 individual controls

• NIST frameworks are used widely in global supply chains

Despite their importance, these frameworks are often inaccessible for SMEs that lack dedicated cyber teams. Many do not know where to start, how to interpret the requirements, or how to sustain compliance once achieved. She noted that certification processes can cost up to $100,000—prohibitively expensive for small businesses already focused on keeping operations afloat.

Her team’s research identified four key pain points:

1. Overly complex and fragmented standards

2. Lack of in-house expertise

3. High cost and time burden of certification

4. Difficulty maintaining accreditation long-term

To address this gap, Dr Romano introduced Cyber QAAI, an AI-powered initiative that aims to support SMEs by automating readiness assessments, generating tailored roadmaps, simplifying documentation, and providing real-time Q&A support—ultimately lowering the barrier to entry for secure participation in government supply chains.

In the second half of her talk, she spotlighted another major research area: technology-facilitated domestic abuse. As digital technologies become more embedded in daily life, perpetrators increasingly exploit them for surveillance, coercion, and control. Dr Romano emphasised that technology can simultaneously strengthen protection—through safety apps, online support networks, secure information sharing, and rapid-exit features—if implemented responsibly.

She closed with a call to action, inviting SMEs, potential partners, and grant collaborators to work with her team through ongoing CSIRO ON programs as they translate research into tools that deliver real-world impact.