Managing Third-Party Risk in Modern Government Software Supply Chains

Governments across Australia and New Zealand moved decisively toward cloud-based platforms to improve the resilience, scalability and performance of digital services. In Australia, the new Whole-of-Government Cloud Policy set a clear direction for agencies to prioritise cloud computing solutions, strengthen security and governance, and move away from ageing ICT environments, with the policy taking effect from 1 July 2026.

This shift placed new pressure on how software was built, secured and released. As agencies increased the pace of change and relied more heavily on third-party components and automated delivery pipelines, traditional controls designed for slower, on-premises environments proved inadequate. Fragmented DevOps practices, limited visibility of software components and inconsistent security integration increased exposure to supply chain vulnerabilities.

For senior decision-makers, this became an accountability issue. Cloud policies, cyber security expectations and audit scrutiny required executives to demonstrate that software deployed into cloud environments was secure, governed and traceable. Without stronger assurance mechanisms aligned to cloud-first delivery, agencies faced the risk of service disruption, compliance failures, escalating remediation costs and loss of public trust at a time when digital services underpinned essential government functions.

Key discussion points:

• Aligned software delivery with cloud policy requirements: How leaders ensured DevSecOps practices supported whole-of-government cloud direction and accountability expectations.
• Strengthened assurance over software components and dependencies: Why visibility of code, artefacts and third-party components was critical in cloud-based environments.
• Embedded security and compliance into automated delivery: How governance and policy controls were enforced consistently as release frequency increased.
• Managed supply chain risk in shared and multi-cloud environments: What effective oversight looked like when software spanned agencies, vendors and platforms.
• Supported executive confidence in cloud-enabled delivery: How coordinated governance enabled speed without sacrificing control or assurance.

This session was intended for senior public sector leaders responsible for cloud strategy, digital delivery, cyber security and software assurance across government and public sector entities.

Meet your facilitators

Jesse Emery

Director Secretariat , Strategy and Prioritisation Branch, Digital Transformation Agency

Yashaswi Mudumbai

Senior Director of Solution Engineering, APAC, JFrog

Mike Holland

Senior Solutions Engineer, ANZ, JFrog