Skip to main content

What reporting or monitoring, if any, does the Public Service Commission receive from ministries, departments or agencies regarding compliance with section 3.2 of the New Zealand Information Security Manual? and 10 other questions

Answered 11 questions (2026)
Questions published
Reply lodged
Bookmark

Asked by

Priyanca Radhakrishnan

List MP · Labour Party

Questions

  • 5654

    What reporting or monitoring, if any, does the Public Service Commission receive from ministries, departments or agencies regarding compliance with section 3.2 of the New Zealand Information Security Manual?

  • 5655

    In which ministries, departments, or agencies, if any, is the Chief Information Security Officer (CISO) a member of the senior leadership team?

  • 5656

    In which agencies, if any, does the Chief Information Security Officer (CISO) report to a tier-2 or tier-3 manager rather than directly to the Chief Executive?

  • 5662

    Which Public Service departments, ministries or agencies, if any, have a Chief Information Security Officer (CISO) whose secondary role is as Chief Information Security Officer?

  • 5663

    In which Public Service departments, ministries or agencies, if any, is the Chief Information Security Officer (CISO) combined with operational IT management responsibilities?

  • 5664

    Which Public Service departments, ministries or agencies, if any, have a Chief Information Security Officer (CISO) who also holds other substantive responsibilities?

Show the remaining 5 questions

  • 5665

    Which Public Service departments, ministries or agencies, if any, have a Chief Information Security Officer (CISO) whose role is part-time?

  • 5666

    Which Public Service departments, ministries or agencies, if any, have a Chief Information Security Officer (CISO) whose role is full time?

  • 5667

    Which Public Service departments, ministries or agencies, if any, have a Chief Information Security Officer (CISO) whose only role is as CISO?

  • 5668

    Which Public Service departments, ministries or agencies, if any, do not have a formally appointed Chief Information Security Officer (CISO)?

  • 5669

    Which Public Service departments, ministries or agencies, if any, currently have a formally appointed Chief Information Security Officer (CISO)?

Answered by

Hon Judith Collins

Member for Papakura · National Party · Minister responsible for the GCSB

Answer

The Director-General of the GCSB holds the Government Chief Information Security Officer (GCISO) role. The GCISO promulgates the New Zealand Information Security Manual (NZISM), which details processes and controls essential for the protection of all New Zealand Government information and systems. The NZISM is intended for use by New Zealand Government departments, agencies and organisations. Crown entities, local government and private sector organisations are also encouraged to use the NZISM. All 40 mandated government agencies have reported that they have a CISO, as have all 7 voluntary reporting agencies. Crown entities are not mandated under the PSR or GCSIO. The PSR specifies that the CISO role should be a senior leader or an equivalent management position. The PSR Assurance Framework has only asked agencies to confirm that they have a designated CISO role; it has not asked agencies to outline the details of this role. It is common that an agency CISO will also have another role within the agency. This reporting year, the PSR has rolled out a new PSR Assurance Framework that asks some more specific questions relating to the CISO role, specifically around conflicts of interest, whether the CISO is a senior leader, and accountability arrangements if the role is outsourced (virtual CISO). PSR-reporting submissions by agencies are due 30 April 2026.