{"id":17,"date":"2026-08-31T21:13:07","date_gmt":"2026-08-31T21:13:07","guid":{"rendered":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/?page_id=17"},"modified":"2026-09-05T22:16:16","modified_gmt":"2026-09-05T22:16:16","slug":"new-zealand-cyber-security-strategy-2019","status":"publish","type":"page","link":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/?page_id=17","title":{"rendered":"New Zealand Cyber Security Strategy 2019"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n \t\t
\n\t\t\t\t\t\t\t\t\t

New Zealand’s Cyber Security Strategy 2019<\/h1>

Building a Confident and Secure Digital New Zealand<\/h2>

Cyber security is an important part of protecting New Zealand’s people, businesses, organisations and critical systems.<\/p>

New Zealand’s Cyber Security Strategy 2019 established a national framework for responding to cyber threats and improving the country’s ability to operate safely in the digital world.<\/p>

The strategy was published by the Department of the Prime Minister and Cabinet on 2 July 2019<\/strong>.<\/p>

The 2019 strategy has since been superseded by a newer national cyber security strategy. However, the 2019 strategy remains relevant because it demonstrates New Zealand’s approach to cyber security during that period.<\/p>

What was the purpose of the strategy?<\/h2>

The strategy’s vision was for New Zealand to be confident and secure in the digital world<\/strong>.<\/p>

Digital technology provides significant benefits to individuals, businesses and communities, but it also creates risks.<\/p>

Cyber attacks can affect:<\/p>

  • Personal information<\/p><\/li>

  • Businesses<\/p><\/li>

  • Government services<\/p><\/li>

  • Financial systems<\/p><\/li>

  • Critical infrastructure<\/p><\/li>

  • Digital services<\/p><\/li><\/ul>

    The strategy recognised that cyber security is not solely the responsibility of the government.<\/p>

    Individuals, businesses, communities and government organisations all have roles to play in keeping New Zealand secure.<\/p>

    The Five Priorities<\/h1>

    The Cyber Security Strategy 2019 identified five key priorities.<\/p>

    Priority 1 \u2014 Cyber security aware and active citizens<\/h2>

    New Zealanders need to understand cyber security risks and know how to protect themselves online.<\/p>

    This includes developing awareness of issues such as:<\/p>

    • Phishing<\/p><\/li>

    • Online scams<\/p><\/li>

    • Password security<\/p><\/li>

    • Malware<\/p><\/li>

    • Social engineering<\/p><\/li>

    • Protection of personal information<\/p><\/li>

    • Safe use of online services<\/p><\/li><\/ul>

      Education and awareness can reduce the likelihood of individuals becoming victims of cyber attacks.<\/p>

      For example, understanding how to identify a phishing email can prevent someone from accidentally providing their password or financial information to a cybercriminal.<\/p>

      Priority 2 \u2014 A strong and capable cyber security workforce and ecosystem<\/h2>

      New Zealand needs skilled cyber security professionals and organisations capable of responding effectively to cyber threats.<\/p>

      The strategy recognised the importance of developing:<\/p>

      • Cyber security skills<\/p><\/li>

      • Technical capabilities<\/p><\/li>

      • Professional expertise<\/p><\/li>

      • Industry collaboration<\/p><\/li>

      • Information sharing<\/p><\/li>

      • Organisational resilience<\/p><\/li><\/ul>

        For IT professionals, this means keeping knowledge and skills up to date as technologies and cyber threats continue to change.<\/p>

        Cyber security professionals need to understand emerging threats and technologies rather than relying only on security practices that were effective in the past.<\/p>

        Priority 3 \u2014 Internationally active<\/h2>

        Cyber threats do not stop at national borders.<\/p>

        New Zealand therefore needs to work with international partners to:<\/p>

        • Share cyber security information<\/p><\/li>

        • Respond to international threats<\/p><\/li>

        • Investigate cybercrime<\/p><\/li>

        • Improve international cooperation<\/p><\/li>

        • Contribute to global cyber security efforts<\/p><\/li><\/ul>

          International cooperation is particularly important because cybercriminals can operate from other countries and cyber attacks can involve infrastructure located across multiple jurisdictions.<\/p>

          A cyber attack against a New Zealand organisation may therefore involve systems, attackers or services located overseas.<\/p>

          Priority 4 \u2014 Resilient and responsive New Zealand<\/h2>

          Organisations need to be able to prevent, withstand and recover from cyber incidents.<\/p>

          Cyber resilience includes:<\/p>

          • Preparing for cyber attacks<\/p><\/li>

          • Protecting systems and information<\/p><\/li>

          • Detecting unusual activity<\/p><\/li>

          • Responding to incidents<\/p><\/li>

          • Recovering systems and services<\/p><\/li>

          • Learning from previous incidents<\/p><\/li><\/ul>

            Organisations should therefore have appropriate security controls and incident response processes rather than assuming that an attack will never happen.<\/p>

            Examples of measures that can improve cyber resilience include:<\/p>

            • Secure backups<\/p><\/li>

            • Incident response plans<\/p><\/li>

            • Security monitoring<\/p><\/li>

            • Access controls<\/p><\/li>

            • Multi-factor authentication<\/p><\/li>

            • Regular security testing<\/p><\/li>

            • Staff cyber security training<\/p><\/li><\/ul>

              Priority 5 \u2014 Proactively tackle cybercrime<\/h2>

              Cybercrime needs to be actively addressed through cooperation between relevant organisations and agencies.<\/p>

              This includes improving the ability to:<\/p>

              • Prevent cybercrime<\/p><\/li>

              • Detect cybercrime<\/p><\/li>

              • Investigate cybercrime<\/p><\/li>

              • Respond to cyber-enabled crime<\/p><\/li>

              • Share information about threats<\/p><\/li>

              • Support victims of cybercrime<\/p><\/li><\/ul>

                Cybercrime can affect individuals, businesses, government organisations and critical infrastructure.<\/p>

                How does the strategy guide organisations?<\/h1>

                The strategy provides a national direction that organisations can use when considering their own cyber security practices.<\/p>

                An organisation should consider:<\/p>

                • What information and systems need protection?<\/p><\/li>

                • What cyber threats could affect the organisation?<\/p><\/li>

                • Who is responsible for security?<\/p><\/li>

                • How will incidents be detected?<\/p><\/li>

                • What happens if an attack occurs?<\/p><\/li>

                • How will the organisation recover?<\/p><\/li>

                • How will employees be educated?<\/p><\/li>

                • How will suppliers and third-party services be managed?<\/p><\/li><\/ul>

                  Cyber security should be treated as an ongoing process rather than a one-time task.<\/p>

                  Practical security measures can include:<\/p>

                  • Strong authentication<\/p><\/li>

                  • Multi-factor authentication<\/p><\/li>

                  • Regular software updates<\/p><\/li>

                  • Secure backups<\/p><\/li>

                  • Access controls<\/p><\/li>

                  • Encryption<\/p><\/li>

                  • Staff cyber security training<\/p><\/li>

                  • Security monitoring<\/p><\/li>

                  • Incident response plans<\/p><\/li>

                  • Regular security testing<\/p><\/li><\/ul>

                    Cyber security and IT professionals<\/h1>

                    IT professionals have an important role in turning cyber security principles into practical systems.<\/p>

                    When developing software or managing infrastructure, professionals should consider security throughout the system’s lifecycle.<\/p>

                    For example, a developer should not simply build a system and add security afterwards.<\/p>

                    Security should be considered during:<\/p>

                    1. Planning<\/p><\/li>

                    2. Development<\/p><\/li>

                    3. Testing<\/p><\/li>

                    4. Deployment<\/p><\/li>

                    5. Operation<\/p><\/li>

                    6. Ongoing maintenance<\/p><\/li><\/ol>

                      Considering security throughout the lifecycle can reduce vulnerabilities and help protect users, systems and organisations.<\/p>

                      IT professionals should also consider how their technical decisions could affect the confidentiality, integrity and availability of information.<\/p>

                      M\u0101ori perspectives on digital safety<\/h1>

                      Cyber security also needs to consider the interests of M\u0101ori communities.<\/p>

                      M\u0101ori Data Sovereignty recognises that M\u0101ori have rights and interests in M\u0101ori data and that data governance should support M\u0101ori wellbeing, language and culture.<\/p>

                      M\u0101ori Data Sovereignty principles<\/h2>

                      The principles of M\u0101ori Data Sovereignty include:<\/p>

                      Rangatiratanga \u2014 Authority and control<\/h3>

                      Rangatiratanga relates to M\u0101ori authority and control over M\u0101ori data and data ecosystems.<\/p>

                      Whakapapa \u2014 Relationships and context<\/h3>

                      Whakapapa recognises the relationships, origins and context associated with data.<\/p>

                      Whanaungatanga \u2014 Obligations<\/h3>

                      Whanaungatanga recognises the obligations and relationships between individuals, communities and data.<\/p>

                      Kotahitanga \u2014 Collective benefit<\/h3>

                      Kotahitanga focuses on ensuring that data can provide benefits to M\u0101ori individuals and communities.<\/p>

                      Manaakitanga \u2014 Respect and reciprocity<\/h3>

                      Manaakitanga emphasises respect, dignity and reciprocity when collecting and using data.<\/p>

                      Kaitiakitanga \u2014 Guardianship<\/h3>

                      Kaitiakitanga relates to protecting and responsibly managing M\u0101ori data.<\/p>

                      Why are M\u0101ori perspectives important to cyber security?<\/h2>

                      Protecting data is not only about preventing hackers from accessing a database.<\/p>

                      It can also involve considering:<\/p>

                      • Who controls the information?<\/p><\/li>

                      • Where is the information stored?<\/p><\/li>

                      • Who has access to it?<\/p><\/li>

                      • How is the information interpreted?<\/p><\/li>

                      • How is the information being used?<\/p><\/li>

                      • Who benefits from the information?<\/p><\/li>

                      • Could the use of the information cause harm?<\/p><\/li>

                      • Are M\u0101ori communities involved in decisions about their data?<\/p><\/li><\/ul>

                        For example, an organisation could have strong passwords, encryption and firewalls while still failing to consider whether the organisation has appropriate authority to collect or use particular M\u0101ori data.<\/p>

                        A stronger approach to cyber security can therefore combine technical protection with cultural awareness, appropriate data governance and community engagement.<\/p>

                        Why does cyber security matter?<\/h1>

                        Cyber security affects everyone who uses digital technology.<\/p>

                        A successful cyber attack can result in:<\/p>

                        • Financial loss<\/p><\/li>

                        • Identity theft<\/p><\/li>

                        • Loss of personal information<\/p><\/li>

                        • Business disruption<\/p><\/li>

                        • Reputational damage<\/p><\/li>

                        • Loss of public trust<\/p><\/li>

                        • Disruption to important services<\/p><\/li><\/ul>

                          Cyber attacks can also have wider effects when they target organisations that provide essential services or operate critical infrastructure.<\/p>

                          Strong cyber security helps organisations protect their users, maintain reliable services and maintain confidence in digital technology.<\/p>

                          Cyber security as a shared responsibility<\/h1>

                          The Cyber Security Strategy 2019 demonstrates that cyber security is not the responsibility of IT departments alone.<\/p>

                          Different groups have different responsibilities.<\/p>

                          Individuals<\/h3>

                          Individuals can help protect themselves by:<\/p>

                          • Using strong and unique passwords<\/p><\/li>

                          • Enabling multi-factor authentication<\/p><\/li>

                          • Recognising phishing attempts<\/p><\/li>

                          • Keeping software updated<\/p><\/li>

                          • Protecting personal information<\/p><\/li>

                          • Reporting suspicious activity<\/p><\/li><\/ul>

                            Businesses and organisations<\/h3>

                            Organisations can help protect their systems by:<\/p>

                            • Implementing security controls<\/p><\/li>

                            • Training employees<\/p><\/li>

                            • Protecting sensitive information<\/p><\/li>

                            • Monitoring systems<\/p><\/li>

                            • Preparing incident response plans<\/p><\/li>

                            • Maintaining secure backups<\/p><\/li>

                            • Managing third-party risks<\/p><\/li><\/ul>

                              Government<\/h3>

                              Government organisations have responsibilities for:<\/p>

                              • National cyber security<\/p><\/li>

                              • Supporting cyber security capability<\/p><\/li>

                              • Responding to significant threats<\/p><\/li>

                              • Working with international partners<\/p><\/li>

                              • Tackling cybercrime<\/p><\/li>

                              • Supporting organisations and communities<\/p><\/li><\/ul>

                                Effective cyber security therefore depends on cooperation between individuals, organisations, industry and government.<\/p>

                                Summary<\/h2>

                                New Zealand’s Cyber Security Strategy 2019 established a national approach to improving cyber security and creating a confident and secure digital environment.<\/p>

                                Its five priorities focus on:<\/p>

                                1. Cyber security aware and active citizens<\/p><\/li>

                                2. A strong and capable cyber security workforce and ecosystem<\/p><\/li>

                                3. International cooperation<\/p><\/li>

                                4. Resilience and responsiveness<\/p><\/li>

                                5. Proactively tackling cybercrime<\/p><\/li><\/ol>

                                  For IT professionals, the strategy demonstrates that cyber security is both a technical and organisational responsibility.<\/p>

                                  Security needs to be considered throughout the technology lifecycle, from planning and development through to deployment, maintenance and incident response.<\/p>

                                  Ethical cyber security also requires consideration of the people and communities affected by digital systems.<\/p>

                                  In Aotearoa New Zealand, this includes M\u0101ori perspectives on data, authority, protection, cultural values and collective wellbeing.<\/p>

                                  References<\/h2>

                                  Department of the Prime Minister and Cabinet. (2019, July 2). New Zealand’s Cyber Security Strategy 2019<\/em>.<\/p>

                                  Te Mana Raraunga. (2018). Principles of M\u0101ori Data Sovereignty<\/em>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\n<\/div>\n

                                  \n\t\t\t\t\t
                                  \n\t\t\t\t
                                  \n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"image\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

                                  New Zealand’s Cyber Security Strategy 2019 Building a Confident and Secure Digital New Zealand Cyber security is an important part of protecting New Zealand’s people, businesses, organisations and critical systems. New Zealand’s Cyber Security Strategy 2019 established a national framework for responding to cyber threats and improving the country’s ability to operate safely in the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-17","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/pages\/17","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17"}],"version-history":[{"count":13,"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/pages\/17\/revisions"}],"predecessor-version":[{"id":247,"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=\/wp\/v2\/pages\/17\/revisions\/247"}],"wp:attachment":[{"href":"https:\/\/wordpress.alex.dipwww.visioncollege.ac.nz\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}