Was the Government Communications Security Bureau involved in the development, procurement, privacy assessment, and/or hosting arrangements for Student Monitoring, Assessment and Reporting Tool (SMART); if not, why not?

Answer

No, the GCSB was in not involved in the development, procurement, privacy assessment, and/or hosting arrangements for the Student Monitoring, Assessment and Reporting Tool (SMART). The Ministry adhered to the Government Procurement Rules, administered by the Ministry of Business, Innovation and Employment, that do not require agencies to consult the GCSB when procuring cloud based data services. Digital government guidance issued by the Department of Internal Affairs provides expectations for Information and Communications technology (ICT) procurement and assurance but does not mandate agency engagement with GCSB for cloud service selection. The New Zealand Information Security Manual sets out security risk management requirements for ICT systems, including cloud services, but it does not require agencies to notify or seek approval from GCSB as part of procurement processes. All relevant processes (business case, procurement and ongoing configuration work) complied with the All of Government procurement and security standards, including those relating to data hosting.