Proposed Terms of Reference for the refresh of New Zealand’s Cyber Security Strategy and Action Plan are attached at Annex One. D an d What should be covered by the cyber security refresh? Officials have informed me of a number of areas that can contribute to an improved systemic approach to identifying, managing and reducing the consequences of cyber security risks. at io ns 43. un ic The complex cyber security landscape: partnership The current Strategy deliberately takes a broad approach to improving the cyber security of New Zealand, emphasising multiple actions rather than a single intervention. This reflects the range of threat actors and the variety of cyber threats which can affect government agencies, the corporate sector, small businesses and individuals. A broad range of agencies, in partnership with the private sector, is required to contribute to New Zealand’s cyber security. 45. The cyber security landscape is complex. In the national security context, it is recognised that risks have effects across the system, beyond the remit of any single agency. To achieve national resilience, agencies must contribute to a systemic approach to identifying and managing risks. Likewise, I consider that a systemic approach is essential for New Zealand to deal with the cyber security challenge. 46. Just as I have proposed with the Digital Strategy, I would like this refresh to consider ways to promote a more joined-up approach to cyber security by government agencies, in cooperation with the private sector and non-government organisations. The current Strategy emphasises, as one of its four principles, that partnerships are essential. th e M in is te ro fB ro ad ca s tin g, C om m 44. This refresh of the Cyber Security Strategy and Action Plan provides an opportunity to look at the cyber security roles of agencies. We need to continue assessing whether we have the optimal arrangements and resources for effectively addressing cyber security efforts across government. The State Services Commission will be closely involved if any machinery of government issues arise in this context. R el ea se d by 47. 48. ia 42. ed Much can be learned from two-way engagement with like-minded and similarsized countries. Estonia, the Netherlands, Israel and Singapore are particular exemplars (with Singapore drawing heavily on New Zealand’s 2015 Strategy). Australia, the United Kingdom, and the Scandinavian countries have also developed sound and robust strategies for dealing with the cyber security challenge. We have strong contacts with counterparts in these countries and a track record of working with them and learning from each other on priorities and current approaches to cyber security. ig ita lM 41. In this regard, work is underway to improve the system-wide understanding and mitigation of cyber security risks to government agencies. We must ensure the integrity and security of our increasingly digitalised government services. 4iz7hypmdw 2018-04-04 16:36:02 Page 7