UNCLASSIFIED Section 1 – What and When to Notify Network Operators Duty to Engage in Good Faith Section 46(2) of the TICSA  A network operator must act honestly and in good faith when engaging with the Director-General in relation to any matter in this Part [Part 3 of TICSA]. The obligation in section 46(2) to act honestly and in good faith is relevant for network operators and GCSB’s engagement with each other throughout the TICSA network security processes. For example, a network operator engaging with GCSB of a network security risk they become aware of as soon as they have identified and considered it, is acting in good faith. Good faith also underlines a network operator’s obligation under s 46(3) to provide the GCSB with access to its employees, contractors or agents that are best placed to assist the GCSB in relation to a matter under Part 3 of the TICSA. When to Notify The duty to notify or engage with the GCSB about certain proposed decisions, courses of action or changes is found in sections 48 and 46(1) of the TICSA. It is important to keep in mind that not all proposals require notification. This section explains what kinds of proposals need to be notified, and when. The TICSA framework ensures the GCSB receives, with the collaboration and input of network operators, the information needed to properly consider, and make decisions about network security risks. The GCSB will follow the same process to identify and address network security risks for proposals notified under both sections 48 and 46(1). Application of Part 3 of TICSA to smaller network operators Under Part 3, all network operators, regardless of size, must notify the GCSB under s 48 of the Act of any proposed decision, course of action, or change within a specified area of security interest. Section 48 – Proposals Affecting Areas of Specified Security Interest Section 48 of the TICSA creates the obligation for network operators to notify the GCSB of proposals (proposed decisions, courses of action or changes) in regard to certain parts of their network. Section 48 Network operator must notify Director-General (1) A network operator must notify the Director-General of any proposed decision, course of action, or change made by or on behalf of the network operator regarding— (a) the procurement or acquisition of any equipment, system, or service that falls within an area of specified security interest; or (b) any change— (i) to the architecture of any equipment, system, or service that falls within an area of specified security interest; or (ii) that may affect the ownership, control, oversight, or supervision of any equipment, system, or service that falls within an area of specified security interest. (2) The network operator must— Contact the TICSA team at ticsa@ncsc.govt.nz Page 6