NSW agencies struggle with security basics