Annex Two: The cyber security role of government agencies The National Cyber Policy Office (NCPO) was established within the Department of the Prime Minister and Cabinet in 2012. It leads the development of cyber security policy advice for the government and advises the government on its investment of resources in cyber-security activities. It also engages with the private sector on cyber policy issues and leads New Zealand’s engagement on international cyber policy matters (with the Ministry of Foreign Affairs and Trade). The NCPO developed the 2015 Cyber Security Strategy and Action Plan and oversees its implementation.  The Government Communications Security Bureau, through the National Cyber Security Centre (NCSC), detects, disrupts and responds to cyber threats against public and private sector organisations of national significance. It delivers cyber threat intelligence to customers and partners. GCSB information assurance activities include providing high-grade encryption services to protect classified information and assessing proposed outer space and high altitude activity and changes to telecommunications networks for risks to national security. It also provides information assurance and security guidance to government agencies including through the Information Security Manual, which is an integral component of the Protective Security Requirements.  The New Zealand Security Intelligence Service (NZSIS) delivers the Protective Security Requirements, which includes information security, for government agencies.  New Zealand Police addresses cybercrime (particularly through the Police Cybercrime Unit within the High Tech Group), which is one of the four goals of the Cyber Security Strategy.  The Ministry of Justice (MOJ) works on the rule of law and justice sector policy, including oversight of the Harmful Digital Communications Act 2015 and the review of the Privacy Act 1993 – the latter includes proposals on data breach reporting.  The Ministry of Business, Innovation and Employment (MBIE) links with cyber security in the areas of communications policy, the Digital Economy Work Programme, research and innovation, consumer advice, and support for small businesses. MBIE advises the Minister for Communications on the implementation of the Telecommunications (Interception Capability and Security) Act 2013, which sets out the obligations of the communications industry in relation to legal interception and network security. R el ea se d by th e M in is te ro fB ro ad ca s tin g, C om m un ic at io ns an d D ig ita lM ed  ia Cyber security issues intersect with the work of a wide range of other government agencies including in the areas of national security and intelligence, defence, international relations, trade and economic development, criminal justice, education, government digitalisation, and public service delivery. The key agencies include:  CERT NZ receives reports of cyber incidents, analyses threats, shares information and advice, coordinates incident responses, and is a point of contact for the international CERT community. CERT NZ has been set up, initially, as a branded business unit within MBIE.  The Department of Internal Affairs (DIA) is the home of the Government Chief Digital Officer – the functional lead for the government’s information communications technology strategy. The Department of Internal Affairs includes the Electronic Messaging Compliance Unit (anti-spam) and Censorship Compliance Unit. Page 16 4iz7hypmdw 2018-04-04 16:36:02