Government agencies routinely send and receive sensitive information beyond their own boundaries, collaborating with contractors, suppliers, consultants and external partners to deliver essential programs and services.
Yet while significant resources are invested in protecting information within government environments, maintaining that same level of security once information is shared externally presents a different challenge.
The question has moved beyond whether information can be transferred securely, to whether agencies can retain visibility, control and accountability over how it is accessed and used.
With artificial intelligence increasingly embedded in everyday workflows, that challenge is becoming more complex.
Information sharing doesn’t stop at the agency boundary
In my work with government agencies and their partners, I’ve found that sharing sensitive information between agencies generally presents fewer challenges than sharing it with external organisations.
Essential reading for Australia’s public service.
Stay ahead of policy shifts, leadership moves, and the big ideas shaping the public service. Sign up to The Mandarin’s free newsletters.
By continuing, you agree to our Terms & Conditions and Privacy Policy.
Australian Public Service employees are typically familiar with government classification systems and their responsibilities when handling sensitive information.
External parties, however, may lack the same experience or security maturity, even when documents are clearly marked as OFFICIAL: Sensitive or PROTECTED.
Information entrusted to third parties may consequently be stored or handled according to security standards that don’t adequately reflect its sensitivity.
Most agencies understand their obligations. The difficulty often lies in translating those requirements into practical processes.
For example, does sending a sensitive document as an email attachment adequately protect that information once it reaches its destination?
Secure transfer is only the starting point
Encryption and authentication help protect information during transfer, but cannot guarantee its security once received.
Ideally, sensitive information should remain physically and logically under the originating agency’s control, even when external collaboration is required.
Where that isn’t possible, agencies must consider what happens after the transfer.
Who can access the information? Can they download, edit or redistribute it? And can the originating agency determine whether that access remains appropriate?
AI introduces another consideration.
A document shared with an authorised individual could subsequently be accessed by an AI assistant to generate a summary or support other business activities.
While these tools offer productivity benefits, agencies must consider whether this additional, potentially non-human access is authorised and appropriate.
Secure collaboration must therefore extend throughout the information lifecycle, rather than treating the initial transfer as the end of an agency’s responsibility.
Moving from sharing files to controlling access
Maintaining control means establishing clear permissions around who can access information and what they’re authorised to do with it.
Depending on its sensitivity, agencies may need to restrict documents to view-only access, prevent downloading or redistribution, establish expiry conditions or revoke permissions when they’re no longer required.
These controls should be supported by visibility over how information is used.
Agencies should have access to near real-time activity logs showing when documents are accessed, opened, shared or downloaded.
This supports accountability and productivity, allowing teams to confirm information has reached its intended recipients.
Rather than overwhelming administrators with notifications, policies should identify potentially problematic activity requiring investigation.
This also supports information provenance: the ability to trace how information has been handled and identify where it may have moved beyond authorised control.
Such visibility helps identify weaknesses in existing processes and reduce the likelihood and impact of breaches.
Security must work for the people using it
Strong security and ease of use are often competing priorities. When sensitive information is involved, security must take precedence.
However, overly complicated systems can create additional risks if employees seek faster, less secure alternatives.
The objective should be to make approved collaboration processes practical for everyday use without compromising necessary safeguards.
Technologies already exist that allow external parties to work with sensitive information through secure browser-based environments, without the underlying files physically leaving agency control.
Additional protections, such as recipient-specific watermarking, can help trace the source of information if it is subsequently captured or disclosed.
While no system can eliminate every risk, combining appropriate technical controls with a usable experience can strengthen information governance.
The boundary shouldn’t be where control ends
Achieving this balance requires agencies to reconsider how cybersecurity is funded and managed.
Government security frameworks, including the Protective Security Policy Framework and Information Security Manual, provide important guidance, but effective implementation must extend beyond traditionally classified information.
Security should be incorporated from the outset when developing new systems, applications and business processes, with protections proportionate to the sensitivity of the information and the threats it faces.
Responsibility must also extend beyond IT departments to the business and application owners who understand how information is used.
As government becomes increasingly interconnected, preventing external information sharing is neither practical nor desirable.
Instead, we must ensure collaboration doesn’t come at the expense of security, visibility or accountability.
While information may need to cross organisational boundaries, our responsibility to protect it doesn’t disappear when it does.
Want to know who has access to your sensitive information after it’s shared? Explore the hidden risks of government file sharing and how to address them.
Read more and download our guide.
About SigBox
SigBox is Macquarie Government’s secure file sharing and collaboration platform for Australian governments and regulated industries. Macquarie Government was formed in 2005 to meet the cyber security needs of Australian governments. Part of ASX-listed Macquarie Technology Group, it now delivers sovereign cloud, cyber security and data centre services to 42% of federal agencies.