Cyber protection of critical infrastructure is 'priority work' but taking at least a year

Detailed summary

Government officials are working on policies to strengthen cyber protection of critical infrastructure more than seven months after consultations closed.

Government officials are working on policies to strengthen cyber protection of critical infrastructure more than seven months after consultations closed.

They are working through submissions to refine policy options, after the February-April public consultation.

"Our intention is to provide advice to ministers early in the next term of government."

Friday's Microsoft Outlook outage has sparked fresh questions about New Zealand's vulnerability to global technology glitches and whether government was doing enough.

"From a cyber security perspective, the government needs to be much more engaged," said frequent critic Don Christie of Catalyst IT.

In early 2026, the officials laid out two new proposed categories of infrastructure that could be subject to mandatory minimum requirements to enhance cyber security and resilience.

Official documents said critical national infrastructure was "increasingly vulnerable to cyber attack".

"Current regulatory settings are not designed to drive a consistent uplift in cyber security across the critical infrastructure system".

It was acknowledged New Zealand's approach was not keeping pace with other countries.

Opening of the article, excerpted from RNZ. To read the rest, open the article on the publisher's site.