UNCLASSIFIED If in Doubt… Network operators may be unsure whether a specific proposal needs to be notified or not. Network operators can contact the GCSB for general guidance about the scope of the notification requirements, but for the avoidance of doubt, network operators should notify the GCSB of the proposal through the template notification form. If the GCSB receives a notification of a proposal that is not required to be notified under TICSA, network operators will be contacted as soon as possible to let them know the notification is not required. Form of Notification A standard template has been created for all network operators to notify the GCSB of proposals. 2 This will assist in the speed of consideration by ensuring a consistent approach by all network operators and that necessary information is provided up front. Notification will not be considered to have been made, until sufficient necessary information has been provided by the network operator to the GCSB. The Notification template is available on the GCSB website. Notifications can be submitted in hard copy or by email. In order to ensure the GCSB is able to consider whether the proposal gives rise to a network security risk, as a start point the following information will be required;          2 Nature of the proposal, objectives, what it is replacing or if it is a new system, the service or function, and an outline of the design and security considerations (self-identified). Hardware, software, vendors, services used and any subcontractors expected to be involved in or considered under the proposal (if known). Which section the notification is made under: section 48 (proposed decisions, courses of action or changes affecting areas of specified security interest) or, section 46(1) (network operator has identified a potential network security risk regarding any part of their network). Timeframes the network operator is working to (such as proposed dates of RFP or similar process, decision making timeframes). Any identified security risks in the proposal. Any additional information relevant to assess the proposal, (this can include material taken from business cases, security/risk assessments; details of any applicable standards used, and network architecture diagrams). When providing notification about a change to Services, network operators will need to provide sufficient information to understand the service that will be provided, how the effective ownership, oversight and control is exercised and the security controls that will be employed. http://www.ncsc.govt.nz/ticsa Contact the TICSA team at ticsa@ncsc.govt.nz Page 10