What tools, steps or processes, if any, does MoD/NZDF have in place for contracts for all new and upgraded IT systems and services that ensure sensitive data cannot be accessed by the US government and intelligence services?

Answer

The New Zealand Defence Force conducts due diligence on all its information capabilities, formally certifying and accrediting them to ensure that all risks and threats to the confidentiality, integrity and availability of information are negated or mitigated to a minimum acceptable level. The process includes conducting risk and threat assessments, creating system security plans, ensuring all access controls are configured correctly, and having monitoring in place to provide alerts for any data breaches. Physical and administrative segregation of network information is in place to separate New Zealand sovereign data from that which is accessed by FVEY and other security partners.