NSW Department of Premier and Cabinet logo

Department of Premier and Cabinet

Department of Premier and Cabinet Circular

C2021-08 Reporting Security Incidents


The procedures for reporting security incidents should be noted and adopted. A key component of reporting all threats is the completion of the Threat Checklist and the reporting process. The process includes the NSW Police Force (NSW Police) and the Commonwealth, particularly when relating to national security issues or terrorism activity.

Function and Subject

Strategic Security (1)
Incident and Emergency Management


Detailed Outline


The Threat Checklist should be readily accessible by all agency personnel, particularly personnel operating public inquiry lines or similar.

The NSW Government may receive correspondence that reveals a risk that the author or someone they know will commit a criminal act, including a terrorist attack. The reporting of direct threats against people or places is via the emergency service number of triple-zero (000), NSW Police Area Commands, and when applicable to the National Security Hotline.

The Commonwealth Department of Home Affairs has provided guidelines for the referral of correspondence to the National Security Hotline if it is of a national security concern. Referrals to the National Security Hotline complement and do not replace other existing procedures and processes for the handling of such correspondence.

The head of a NSW Government agency or equivalent will determine if it is necessary to inform his or her Minister.

Threat: Verbal Information

Current telephone technology allows for the retention of relevant data to identify the origin of threatening or suspicious telephone calls. This also applies to calls received on mobile phones. Although it is almost certain the relevant call data will be time or date stamped (electronically), it is still critical to recall or record all relevant information that may assist with the identification/origin of the call.

If the threat, or information relayed in the call relates to an immediate or imminent threat to national security or endangering life or property, triple-zero (000) is the primary contact. Where required, subsequent collection of evidence and investigation by NSW Police will follow. The call information/data must be collected and retained during this process utilising the Threat Checklist provided. This information will help to determine what operational response, if any, will be taken.

For threatening or suspicious phone calls that do not pose an imminent or immediate threat, this should be reported to local NSW Police for investigation. It is recommended the phone number for the local NSW Police station is provided to all staff.

Agencies are encouraged to review and practice the management of suspicious articles or other threatening scenarios (improvised explosive device, gas, powder, residue, etc.). Appropriate emergency personnel engaged by the agency or serving the accommodation in which the agency is located should be advised immediately.

Threat: Written Information

In the event that written information of a threatening or offensive nature is received by either normal mail or electronically, the action taken will depend on the nature of the threat. If the threat is non-specific, call the local NSW Police station. If the threat is against a person or place, call triple-zero (000) and if the threat contains specific politically motivated violence or terrorism call triple-zero (000).

If a threatening letter is received, the hard copy of the advice and the envelope (if applicable) is to be immediately sealed in an envelope. Existing emergency procedures for the building should also be followed if considered necessary.

Emails should not be deleted or forwarded to any other recipient.


Where correspondence reveals an imminent threat to a high office holder, it should be referred to NSW Police via triple-zero (000) in the first instance and/or reported to your agency security adviser/representative. It should then be forwarded to VIP@nationalsecurity.gov.au.

These types of correspondence may include:

  • Threats or threatening behaviour;

  • Plans to breach security perimeters (either of buildings or events);

  • Declaration of intent to cause harm at a specific venue or event, or against a specific person;

  • Threats of self-harm and suicidal intent.

Correspondence that is relevant to national security, even if not an imminent threat, should be forwarded to hotline@nationalsecurity.gov.au or by calling 1800 123 400.

Under section 4 of the Australian Security Intelligence Organisation Act 1979 (Cth) ‘security’ means, relevantly:

Attached for your information is the Threat Checklist.

Timothy Reardon


Who needs to know and/or comply with this?

AR Details

Date Issued
Mar 16, 2021
Review Date
Mar 31, 2026
Replaced By


02 9228 5555
Publishing Entity
Department of Premier and Cabinet
Issuing Entity
Department of Premier and Cabinet