The rate of compliance with the government’s cyber security framework has also barely improved in the five years its been in place, a parliamentary committee has heard.

Only four out of 14 government agencies audited by the Auditor-General over the past four years have been found to be complying with their cyber-security requirements, with Auditor-General Grant Hehir saying the current system, where government agencies seek to comply with requirements set out by the Australian Cyber Security Centre, needs to be strengthened.

David Fricker, director-general of the National Archives, told the committee he was concerned small and micro-agencies didn’t have the capability to ensure they were keeping up with requirements in a system that relies on self-assessment.

"There's a weakness built into this system," he said.

"Self assessment and reliance on individual agencies, each with an uneven capability and an uneven technical knowledge, means we're not going to achieve consistent resilience across the Commonwealth. There's always going to be agencies among us that represent the weaker link in the chain."

Mr Fricker said the Archives had found themselves to be non-compliant with one element of the cyber-security system because advice had been mis-interpreted, but that if the agency had more internal knowledge, the issue may not have happened.

"We don’t have a system of certifying somebody within the organisation has the appropriate qualifications to properly assess cyber risk," he said.

"We have computer professionals who are capable of running and administering networks and they won’t necessarily have the specialist knowledge of cyber security and it's a fast-moving threat environment."

It's an issue that needs to be addressed at Commonwealth level, Mr Fricker said.

"We have a patchwork response to cyber resilience across the Commonwealth. We're all interconnected, each one of us has the possibility to infect the network of another and this is an issue we need to collectively address."

Labor MP Julian Hill said it raises questions about the systemic approach to cyber security.

In a sign of how seriously the Department of Parliamentary Services is taking the attempted hack of its network, both the speaker of the House of Representatives Tony Smith and president of the Senate Scott Ryan have signalled they want to answer to the Accounts and Audit committee when it next meets to discuss cyber security issues.

"It is inevitable that a small number of sophisticated threats will evade preventative controls and as a result no system can be considered completely invulnerable," Parliamentary Services secretary Rob Stefanic said in a letter to the committee.

Mr Stefanic refused to detail the department's progress on implementing cyber-security mitigation strategies, saying that to do so "may assist potential malicious actors to refine their methods of attack".