Cyber security of critical infrastructure - consultation

Overview

The New Zealand Government has released New Zealand’s Cyber Security Strategy 2026 - 2030 and Cyber Security Action Plan 2026 - 2027. 

To coincide with the release of the strategy, DPMC have also released a discussion document seeking industry feedback on a new approach to the cyber security of critical infrastructure. The discussion document 'Enhancing the cyber security of NZ's critical infrastructure system' is available on the DPMC website. 

The discussion document asks for feedback on two key questions:

• What are the essential infrastructure services most critical to our economy and communities that they should be safeguard against harm?
• What should the depth of the cyber defences of these infrastructure services be?
  Measures are designed to deliver three outcomes:
  • an improved understanding of threats and vulnerabilities by critical infrastructure entities and government
  • a minimum level of cyber risk management by all critical infrastructure entities
  • effective management of cyber threats impacting national security by critical infrastructure entities

We want to hear views from individuals and organisations on the ideas and measures set out in this document.

We are primarily seeking industry feedback, from owners and operators of New Zealand’s critical infrastructure who would be directly affected by potential regulatory reform. We also welcome input from individuals, businesses and communities who are directly affected by the security and resilience of our critical infrastructure. Your feedback will inform further analysis and advice to Cabinet.

The consultation period runs from 27 February to 11.59pm on 19 April 2026.

• Submissions you make become official information, and the content of submissions can be asked for under the Official Information Act 1982 (OIA). Under the OIA, we must make information available unless there is good reason for withholding it.
• Additionally, we intend to publish all submissions in PDF format on the DPMC website. 
• If you think there are grounds to withhold specific information from publication (for example, that it discloses commercially sensitive or personal information), please make this clear in your submission or contact us.