The Attorney-General's Department has quietly released a report showing how government departments complied with the 36 security requirements of the protective security policy framework in 2016-17, which covers physical security, personnel security, information security and security governance.

The report measures the number of people who were given waivers in order to gain their security clearance, either because they aren't Australian citizens, or because they are considered to have an "uncheckable background" where more than 12 months of the total security clearance background check period couldn't be verified.

Between 2015-16 and 2016-17, the number of non-Australian citizens to be given security clearances doubled from 156 to 317.

The number of non-citizens granted a the top-level positive vetting security clearance stayed steady with three people granted the clearance in 2014-15 and four in each of the following years.

The most significant jump in non-citizens gaining a security clearance was at the negative vetting 1 level, which allows holders to deal with classified information and documents up to "secret" level. It is the second level after baseline.

From 47 non-citizens granted negative vetting 1 in 2015-16, 175 non-citizens were granted the clearance in 2016-17.

"Much of this increase can be attributed a single entity," the report said.

The Attorney-General's Department would not explain which entity was responsible for the increase.

When it comes to those with backgrounds that weren't fully verifiable, the report said a separate government agency was responsible for the hike in clearances.

"Much of this can be attributed to a single entity adjusting its reporting methodology over the year," the report said.

In this case, the department also didn't explain which agency had changed its reporting.

Historically waivers for uncheckable backgrounds have mostly been at the positive vetting level, the report said, reflecting "more onerous PV background checking expectations". However in 2016-17, 137 waivers were granted at negative vetting 1 level, from just seven the year before.

"Where clearance requirements are waived, government faces increased malicious insider risks (and may be more vulnerable to exploitation from organised crime and interference from foreign governments)," the report said.

Senior Analyst at the Australian Strategic Policy Institute's International Cyber Policy Centre Danielle Cave said the increase in "checkable background waivers" was surprising and deserved greater explanation.

"It is concerning that there has been an increase in the number of waivers given out for security concerns, mostly because the reasons behind this increase haven’t been well explained by the government," Dr Cave said.

"One possible explanation, given the timing, is that some of the increase in waivers in 2016-17 were for new political advisers and the result of major ministerial reshuffles that occurred in Parliament both in 2015 and 2016," Dr Cave said.

She also said that there may be national security reasons behind the secrecy around which government agencies were involved, but if that was the case, it should have been explained in the report.

While the report maintained the number of non-citizen waivers was less than 0.2 per cent, and the uncheckable background waivers less than 0.1 per cent of the more than 200,000 clearances given to government workers, Dr Cave said it was important to keep the rate of waivers low.

"The government should be aiming to have as few security clearance waivers in action as possible because, just like cyber threats, malicious insider threats are also a risk to classified government material," Dr Cave said.

The increase from 218 security clearance waivers handed out in total in 2015-16 to a total of 533 in 2016-17 "introduces more unnecessary risk into Australia’s security system and also places a burden on departments like the Attorney-General's Department who are responsible for administering Australia’s protective security policy," Dr Cave said.

The ongoing backlog of security clearances to be approved and the increased number of people requiring clearances could contribute to the increase in agencies requesting waivers for their employees, director of defence and strategy at the Australian Strategic Policy Institute Michael Shoebridge said.

The government could consider moving to more ongoing monitoring to those with clearances to manage security risks, he said.

"This means moving from the big issue being whether or not to issue a clearance, towards an approach based on through career monitoring," he said.

"This can reduce the up front work required for a clearance, as the risk of the individual is monitored over the course of their employment. That would speed up the clearance process."

The report also sounded the alarm over information security at government departments, labelling compliance in the area "an area of ongoing concern".

"Despite increased awareness of cyber security risks, and a concerted effort over the year to promote risk mitigation measures, entity compliance with information security requirements did not see significant change," the report said.

Out of 93 government entities covered in the report, 37 didn't comply with the requirement to ensure their information, IT systems and networks were managed securely, including guarding against hacking attempts. It was the highest rate of non compliance of any of the 36 requirements.

Despite just a third of agencies being fully compliant with all 36 requirements, "the government's security posture is still broadly sound," the report said.

The Australian Government Security Vetting Agency has been under scrutiny since an auditor-general's report found its processes weren't doing enough to protect the government from insider threats.

Even though 43 per cent of vetting assessments in 2015-16 and 2016-17 resulted in potential security concerns, almost all decisions were made to allow the clearance without extra measures to reduce risks, the auditor-general found.