<section title="2.1. Overview of Key Agencies"><subsection title="Objective"><paragraph
    title="2.1.1."


><![CDATA[<p>Agency security personnel and senior management are aware of and utilise information security services offered by the New Zealand Government.</p>]]></paragraph>
 </subsection>
<subsection title="Context"> <block title="Scope"><paragraph
    title="2.1.2."


><![CDATA[<p>This section provides an overview of the GCSB and other government organisations providing information security advice to agencies.</p>
<p>&nbsp;</p>]]></paragraph>
</block>
<block title="Government Communications Security Bureau"><paragraph
    title="2.1.3."


><![CDATA[<p>The Government Communications Security Bureau (GCSB) has two statutory missions: intelligence, and cyber security.</p>
<p>&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.4."


><![CDATA[<p><strong>Intelligence mission</strong></p>
<p>The GCSB uses signals intelligence collection capabilities to produce intelligence that provides decision advantage to government agencies in conduct of their legislatively mandated functions. The provision of this intelligence is one way that the GCSB contributes to the safety and security of New Zealand and New Zealand’s interests.</p>
<p>&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.5."


><![CDATA[<p><strong>Cyber security mission</strong></p>
<p>New Zealand needs cyber security to:&nbsp;</p>
<ul>
<li>protect and maintain the digital services that the country relies on; &nbsp;</li>
<li>protect its intellectual property; &nbsp;</li>
<li>maintain its reputation as a stable and secure place to do business; and&nbsp;</li>
<li>ensure that governmental and democratic processes remain free from interference.</li>
</ul>]]></paragraph>
<paragraph
    title="2.1.6."


><![CDATA[<p>The National Cyber Security Centre (NCSC) supports the GCSB’s cyber security mission, including the Director-General’s system leadership and GCISO responsibilities. &nbsp;</p>
<p>&nbsp;</p>]]></paragraph>
</block>
<block title="National Cyber Security Centre"><paragraph
    title="2.1.7."


><![CDATA[<p>As the Government’s lead operational cyber security agency, the NCSC performs a range of functions, offers services, and supports New Zealand government agencies undertake their cyber security responsibilities. &nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.8."


><![CDATA[<p>The NCSC responds to cyber incidents that potentially affect New Zealand’s security or economic wellbeing. It provides advanced cyber security services and advice to government agencies and nationally significant organisations to help defend them against cyber threats.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.9."


><![CDATA[<p><span>On</span> 31 August 2023 CERT NZ was transferred to the NCSC to create a single operational cyber security agency.</p>]]></paragraph>
<paragraph
    title="2.1.10."


><![CDATA[<p><span>The combined agency engages across the economy to improve the nation’s cyber resilience. </span><span>Supporting&nbsp;nationally significant organisations, businesses, organisations, and individuals who are, or may be, affected by cyber security incidents.</span></p>]]></paragraph>
<paragraph
    title="2.1.11."


><![CDATA[<p>Agencies can contact the NCSC for advice and assistance on the reporting and management of information security incidents.&nbsp; The NCSC’s response will be commensurate with the nature and urgency of the information security incident (see Section 7.2 – Reporting information security incidents).&nbsp; There is a 24 hour, seven day a week service available if necessary, by emailing <a href="mailto:ncscincidents@ncsc.govt.nz">ncscincidents@ncsc.govt.nz</a>.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.12."


><![CDATA[<p>The NCSC provides specialist advice and assistance to New Zealand government departments in relation to cryptography, communications, and various information processing technologies.</p>]]></paragraph>
<paragraph
    title="2.1.13."


><![CDATA[<p>The NCSC publishes the NZISM which sets out the information security requirements for New Zealand government organisations. An agency can contact the NCSC for advice and assistance relating to the interpretation of the NZISM by emailing: <a href="mailto:nzism@ncsc.govt.nz">nzism@ncsc.govt.nz</a>.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.14."


><![CDATA[<p>The NCSC supports regulatory regimes by providing risk assessments and advice to identify and manage risks to New Zealand’s national security. Network operators can contact the Regulatory Unit by email: <a href="mailto:ticsa@ncsc.govt.nz">ticsa@ncsc.govt.nz</a>.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.15."


><![CDATA[<p>The NCSC provides specialised technical security services focussed on countering unauthorised surveillance techniques and emanation security services focussed on preventing spread of unintentional signals. Contact the technical security services team by email:&nbsp;<u><a href="mailto:techliaison@gcsb.govt.nz">techliaison@gcsb.govt.nz</a></u>. &nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.16."


><![CDATA[<p>Finally, agencies can contact the NCSC for advice and assistance on the purchasing, provision, deployment, operation, and disposal of High Assurance Cryptographic Equipment. &nbsp;The cryptographic liaison can be contacted by email at <a href="mailto:cryptohelpdesk@gcsb.govt.nz">cryptohelpdesk@gcsb.govt.nz</a>.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.17."


><![CDATA[<p>For general enquiries the NCSC can be contacted on <a href="mailto:info@ncsc.govt.nz">info@ncsc.govt.nz</a>.&nbsp;</p>
<p>&nbsp;</p>]]></paragraph>
</block>
<block title="Government Chief Information Security Officer"><paragraph
    title="2.1.18."


><![CDATA[<p>The Government Chief Information Security Officer (GCISO) is responsible for the strategic direction and prioritisation of the New Zealand Government’s approach to information security and offers services to protect the Government's most sensitive information.</p>]]></paragraph>
<paragraph
    title="2.1.19."


><![CDATA[<p>The role was created in response to the ongoing evolution of the cyber threat environment, emerging vulnerabilities, and technological change for the New Zealand Government.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.20."


><![CDATA[<p>The GCISO role was established by the Te Kawa Mataaho Public Service Commission in 2018. In July 2022, the Public Service Commissioner formally appointed the GCISO as System Lead for Information Security.</p>]]></paragraph>
<paragraph
    title="2.1.21."


><![CDATA[<p>The GCSB Director-General holds the role of GCISO.</p>]]></paragraph>
<paragraph
    title="2.1.22."


><![CDATA[<p>The GCISO draws on the technical expertise, relationships, and unique insights of both the NCSC and the GCSB to uplift information security practice across government.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.23."


><![CDATA[<p>The objective of the GCISO is to uplift cyber resilience in the Public Service, and enable secure digital transformation through specific initiatives, which focus on:&nbsp;</p>
<ul>
<li>promoting standards and policy.&nbsp;</li>
<li>providing guidance.&nbsp;</li>
<li>promoting secure by design.&nbsp;</li>
<li>technical advice.&nbsp;</li>
<li>increasing service delivery.&nbsp;&nbsp;</li>
<li>building assurance; and &nbsp;</li>
<li>supporting the information security workforce.</li>
</ul>]]></paragraph>
<paragraph
    title="2.1.24."


><![CDATA[<p>The NZISM is a key part of the GCISO's standards setting role. It is developed by the NCSC as part of its support of the GCISO.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.25."


><![CDATA[<p>The GCISO coordinates its system leadership role with other Te Kawa Mataaho Public Service Commission appointed system leaders, particularly the Government Chief Digital Officer (GCDO) and the Government Chief Data Steward (GCDS).&nbsp;</p>
<p>&nbsp;</p>]]></paragraph>
</block>
<block title="Government System Leadership"><paragraph
    title="2.1.26."


><![CDATA[<p><strong>Government Chief Digital Officer</strong></p>
<p>The GCDO is the government system lead for digital. This role oversees the development and management of digital for the state sector. &nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.27."


><![CDATA[<p>The GCDO is responsible for:&nbsp;</p>
<ul>
<li>setting digital policy and standards,&nbsp;</li>
<li>improving investments,&nbsp;</li>
<li>establishing and managing services,&nbsp;</li>
<li>developing capability, and&nbsp;</li>
<li>system assurance (assuring digital government outcomes).&nbsp;</li>
</ul>]]></paragraph>
<paragraph
    title="2.1.28."


><![CDATA[<p><strong>Government Chief Data Steward</strong></p>
<p>The GCDS is the&nbsp;government system lead for data. This role supports the use of data as a resource across government to help deliver better services to New Zealanders.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.29."


><![CDATA[<p>The GCDS responds to new and emerging data issues, and ensures that government agencies have the capability and skills to maximise the value of data. This is achieved through setting data standards, establishing common capabilities, developing data policy, strategy, and planning.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.30."


><![CDATA[<p><strong>Government Protective Security Lead</strong></p>
<p>The Government Protective Security Lead (GPSL) is the functional lead for protective security.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.31."


><![CDATA[<p>The GPSL provides the formal, system-level, functional leadership for government protective security.</p>]]></paragraph>
<paragraph
    title="2.1.32."


><![CDATA[<p><strong>Government Chief Privacy Officer</strong></p>
<p>The Government Chief Privacy Officer (GCPO) is the government practice lead for privacy. This role leads an all-of-government approach to privacy to raise public sector privacy maturity and capability.</p>]]></paragraph>
<paragraph
    title="2.1.33."


><![CDATA[<p>The GCPO&nbsp;is responsible for: &nbsp;</p>
<ul>
<li>providing leadership by setting the vision for privacy across government,&nbsp;</li>
<li>building capability by supporting agencies to lift their capability to meet their privacy responsibilities, &nbsp;</li>
<li>providing assurance on public sector privacy performance,&nbsp;and&nbsp;</li>
<li>engaging with the Office of the Privacy Commissioner and New Zealanders about privacy. &nbsp;</li>
</ul>]]></paragraph>
<paragraph
    title="2.1.34."


><![CDATA[<p><strong>Government Procurement Lead</strong></p>
<p>The Government Procurement Lead is responsible for strengthening leadership and oversight of suppliers and agencies in key procurement sectors.&nbsp; A core part of this role is helping to ensure that agencies collaborate around sourcing and purchasing common goods and services.&nbsp; New Zealand Government Procurement and Property supports the Chief Executive of MBIE in their role as Procurement system lead.</p>]]></paragraph>
<paragraph
    title="2.1.35."


><![CDATA[<p>Procurement system leadership works towards a procurement system that delivers better value for New Zealand and helps people, communities and businesses to thrive. This includes redesigning and repositioning the government procurement system to:</p>
<ul>
<li>make it easy for government agencies and suppliers to work together.</li>
<li>lift procurement capability.</li>
<li>improve the visibility of procurement activities and system performance; and</li>
<li>facilitate and coordinate cross-agency collaboration.</li>
</ul>]]></paragraph>
</block>
<block title="Other government organisations"><paragraph
    title="2.1.36."


><![CDATA[<p><span style="text-decoration: underline;">Archives NZ&nbsp; Te Rua Mahara o te Kāwanatanga&nbsp;</span></p>
<p>Archives NZ is the regulator of information created by the public sector, and reports to Cabinet on the state of Government recordkeeping.</p>]]></paragraph>
<paragraph
    title="2.1.37."


><![CDATA[<p><span style="text-decoration: underline;">Controller and Auditor-General&nbsp; Tumuaki o te Mana Arotake</span>&nbsp;</p>
<p>The Controller and Auditor-General has two business units, the Office of the Auditor-General, and Audit NZ. Together they give Parliament and the public an independent view of how public organisations are operating.</p>]]></paragraph>
<paragraph
    title="2.1.38."


><![CDATA[<p><span style="text-decoration: underline;">Department of Internal Affairs&nbsp; Te Tari Taiwhenua</span></p>
<p>The Department of Internal Affairs has a range of relevant functions, including digital identity and digital safety, and regulatory functions including spam prevention and messaging compliance and money laundering. DIA provides guidance to support government organisations to use generative AI, cloud, enterprise architecture, government domain names, and APIs.</p>]]></paragraph>
<paragraph
    title="2.1.39."


><![CDATA[<p><span style="text-decoration: underline;">Department of the Prime Minister and Cabinet&nbsp; Te Tari o te Pirimia me te Komiti Matua</span></p>
<p>The Department of the Prime Minister and Cabinet’s purpose is to advance an ambitious, resilient, and well-governed New Zealand. The National Security Group business unit provides leadership across New Zealand’s national security community towards a secure and resilient Aotearoa New Zealand. The DPMC works on the Christchurch Call, critical infrastructure, and the National Security Intelligence Priorities.</p>]]></paragraph>
<paragraph
    title="2.1.40."


><![CDATA[<p><span style="text-decoration: underline;">Ministry of Business, Innovation &amp; Employment&nbsp; Hīkina Whakatutuki</span></p>
<p>The MBIE works to ensure that telecommunications markets operate efficiently, and the commerce and ICT infrastructure is well developed. It is responsible for maintaining a robust regulatory environment for the ICT sector, and works to improve broadband and mobile connectivity for New Zealanders.</p>]]></paragraph>
<paragraph
    title="2.1.41."


><![CDATA[<p><span style="text-decoration: underline;">Ministry of Foreign Affairs and Trade&nbsp; Manatū Aorere</span></p>
<p>MFAT ensures that New Zealander’s can live, do business, travel and communicate more safely at home and offshore.</p>]]></paragraph>
<paragraph
    title="2.1.42."


><![CDATA[<p><span style="text-decoration: underline;">New Zealand Police&nbsp; Ngā Pirihimana o Aotearoa</span> &nbsp;</p>
<p>The Police can investigate cybercrime and harmful digital communications.&nbsp;</p>]]></paragraph>
<paragraph
    title="2.1.43."


><![CDATA[<p><span style="text-decoration: underline;">New Zealand Security Intelligence Service&nbsp; Te Pā Whakamarumaru</span></p>
<p>NZSIS’ mission is to keep NZ and New Zealanders safe and secure. The Director-General is the Government Protective Security Lead, and the NZSIS manages the Protective Security Requirements framework and maintains the Information Security Classification System.</p>]]></paragraph>
<paragraph
    title="2.1.44."


><![CDATA[<p><span style="text-decoration: underline;">Office of the Privacy Commissioner&nbsp; Te Mana Mātāpono Matatapu</span></p>
<p>The Office of the Privacy Commissioner works to develop and promote a culture in which personal information is protected and respected.</p>]]></paragraph>
<paragraph
    title="2.1.45."


><![CDATA[<p><span style="text-decoration: underline;">Public Services Commission&nbsp; Te Kawa Mataaho</span></p>
<p>The Public Services Commission monitors Public Service organisations and Chief Executives’ performance.</p>
<p>&nbsp;</p>]]></paragraph>
</block>
</subsection>
<subsection title="References"><paragraph
    title="2.1.46."


><![CDATA[<p>The following websites can be used to obtain additional information about the security of government systems:</p>
<table class="table-main" style="width: 584px;">
<tbody>
<tr>
<td style="width: 349.737px;"><strong>Organisation</strong></td>
<td style="width: 227.863px;"><strong>Source</strong></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Archives New Zealand</strong></td>
<td style="width: 227.863px;"><a title="Archives NZ" rel="noopener noreferrer" href="https://archives.govt.nz" target="_blank">https://archives.govt.nz</a> &nbsp;</td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Audit New Zealand</strong></td>
<td style="width: 227.863px;"><a rel="noopener noreferrer" href="https://auditnz.parliament.nz/" target="_blank">https://auditnz.parliament.nz/</a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Office of the Auditor-General</strong></td>
<td style="width: 227.863px;"><a rel="noopener noreferrer" href="https://oag.parliament.nz/" target="_blank">https://oag.parliament.nz/</a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Department of Internal Affairs</strong></td>
<td style="width: 227.863px;">
<p><a title="Department of Internal Affairs" rel="noopener noreferrer" href="https://dia.govt.nz" target="_blank">https://dia.govt.nz</a> <br><a title="Government Chief Digital Officer (GCDO)" rel="noopener noreferrer" href="https://digital.govt.nz" target="_blank">https://digital.govt.nz</a></p>
</td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Department of Prime Minister and Cabinet</strong></td>
<td style="width: 227.863px;"><a title="Department of Prime Minister &amp; Cabinet" rel="noopener noreferrer" href="https://dpmc.govt.nz" target="_blank">https://dpmc.govt.nz</a> &nbsp;</td>
</tr>
<tr>
<td style="width: 349.737px;"><strong><strong>Government Communications Security Bureau</strong></strong></td>
<td style="width: 227.863px;"><a title="GCSB" rel="noopener noreferrer" href="https://gcsb.govt.nz" target="_blank">https://gcsb.govt.nz</a><a rel="noopener noreferrer" href="http://www.mbie.govt.nz" target="_blank"><span>&nbsp;</span></a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Ministry of Business, Innovation &amp; Employment</strong></td>
<td style="width: 227.863px;"><a title="Ministry of business, innovation &amp; employment" rel="noopener noreferrer" href="https://mbie.govt.nz" target="_blank">https://mbie.govt.nz</a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Ministry of Foreign Affairs and Trade</strong></td>
<td style="width: 227.863px;"><a title="Ministry of Foreign affairs &amp; trade" rel="noopener noreferrer" href="https://mfat.govt.nz" target="_blank">https://mfat.govt.nz</a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>National Cyber Security Centre</strong></td>
<td style="width: 227.863px;"><a title="NCSC" rel="noopener noreferrer" href="https://ncsc.govt.nz" target="_blank">https://ncsc.govt.nz</a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>New Zealand Security Intelligence Service</strong></td>
<td style="width: 227.863px;"><a title="NZ Security Intelligence Service" rel="noopener noreferrer" href="https://nzsis.govt.nz/" target="_blank">https://nzsis.govt.nz</a>&nbsp;</td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>New Zealand Police</strong></td>
<td style="width: 227.863px;"><a title="NZ Police" rel="noopener noreferrer" href="https://police.govt.nz" target="_blank">https://police.govt.nz</a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Privacy Commissioner</strong></td>
<td style="width: 227.863px;"><a title="Privacy Commissioner" rel="noopener noreferrer" href="https://privacy.org.nz" target="_blank">https://privacy.org.nz</a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Protective Security Requirements</strong></td>
<td style="width: 227.863px;"><a title="PSR" rel="noopener noreferrer" href="https://protectivesecurity.govt.nz" target="_blank">https://protectivesecurity.govt.nz</a></td>
</tr>
<tr>
<td style="width: 349.737px;"><strong>Public Service Commission</strong></td>
<td style="width: 227.863px;"><a title="Public Service Commission" rel="noopener noreferrer" href="https://publicservice.govt.nz" target="_blank">https://publicservice.govt.nz</a></td>
</tr>
<tr>
<td style="width: 349.737px;">&nbsp;</td>
<td style="width: 227.863px;">&nbsp;</td>
</tr>
</tbody>
</table>]]></paragraph>
 </subsection>
<subsection title="Rationale &amp; Controls"> <block title="Organisations providing information security services"><paragraph
    title="2.1.47.R.01."

    tags="Governance"


><![CDATA[<p>If security personnel and senior management are not aware of the role government organisations play with regards to information security they could be missing out on valuable insight and assistance in developing an effective information security posture for their agency.</p>]]></paragraph>
<paragraph
    title="2.1.47.C.01."

    tags="Governance"


    classification="All Classifications"
    compliance="Must"
    cid="199"
><![CDATA[<p>Security personnel MUST familiarise themselves with the information security roles and services provided by New Zealand Government organisations.</p>]]></paragraph>
</block>
</subsection>
</section>
