State Comptroller Report Details Cyber Vulnerabilities in Israeli Government Systems

State Comptroller Matanyahu Englman published reports Tuesday that identified continued use of an insecure remote-work platform by the National Digital Agency and 65 percent of ministries for ten months after the National Cyber Directorate ordered its removal.

The platform remained in operation until January 2025. Emergency organizations including the Fire and Rescue Authority and police had not completed required business-continuity plans, emergency exercises, or penetration tests for their remote-work systems.

The Foreign Ministry recorded a roughly 500 percent increase in information-security incidents at missions abroad during the Gaza war, with hundreds of incidents in 2023. Its cyber policy had not been updated since 2018, and its IT steering committee did not meet between 2021 and 2023.

3 million fell at least NIS 20 million short of documented needs, resulting in fourteen projects being frozen or delayed.

The Construction and Housing Ministry maintains databases with millions of records on housing-assistance recipients but had not registered all nine databases as required under privacy-protection regulations. More than half of its systems did not receive the required annual review of user permissions.

6 million citizens were registered in the national identification system, yet only 16 percent of mapped government services were connected to it. Eight of 31 ministries, including the Foreign and Defense ministries, remained unconnected. The National Cyber Directorate stated the audit findings support the need for the Cyber Defense Law approved by the government on Monday for its first reading.

Englman recommended that ministries holding sensitive data update cyber policies, conduct regular testing, restrict access, and prepare continuity plans.