Australia and New Zealand
External attack surface management for New Zealand organisations
New Zealand expects agencies to know every externally facing system they run, and from October 2026 it expects every government domain to pass strict email authentication checks. EASMLens shows you both from the outside, the same way the NCSC and attackers see you.
Serving organisations in Auckland, Wellington, Christchurch.
What the rules in New Zealand expect
Minimum Cyber Security Standards: Standard 3
The NCSC published the Minimum Cyber Security Standards on 30 October 2025 for agencies under the Government Chief Information Security Officer mandate. They apply to all business-critical and externally facing systems.
Standard 3, Assets and their Importance, sets a minimum of maturity level 2: a basic inventory of hardware, software and data, including cloud, with classification applied to critical and externally facing systems. Level 3 gives every asset an owner to help manage shadow IT. Level 4 adds continuous monitoring of changes to assets. Standard 5 suggests applying critical patches to external-facing systems within two days.
Protective Security Requirements
PSR INFOSEC 1.1 asks mandated agencies to identify the information and ICT systems they manage and to create an inventory of them. INFOSEC 4 asks them to monitor for vulnerabilities and apply patches. The PSR is mandatory for mandated agencies and best practice for everyone else, and suppliers to government often receive the same expectations through contracts.
Secure Government Email: October 2026
The Secure Government Email Common Implementation Framework requires agencies, by October 2026, to run DMARC at p=reject on every email-enabled domain, SPF ending in -all, DKIM on all outbound mail, MTA-STS in enforce mode, TLS-RPT and TLS 1.2 as a minimum. Domains that never send email must publish deny-all records.
The Government Digital Services Directorate will monitor SPF, DMARC and MTA-STS across all of government and track new domains. The hardest part is usually the forgotten domain: a campaign site, an old agency name, a parked domain. EASMLens finds those and grades each one against the same checks.
Privacy, finance and the proposed critical infrastructure regime
Under the Privacy Act 2020, notifiable breaches must be reported to the Privacy Commissioner as soon as practicable. The Commissioner’s 2026 inquiry into the Manage My Health breach, affecting 99,416 patients through an internet-facing portal, shows how closely supplier-run services are now examined. The RBNZ expects registered banks, insurers and other regulated entities to report material cyber incidents within 72 hours.
The Government’s February 2026 discussion document proposes a regime for about 200 critical infrastructure entities, with a 24-hour early warning and a 72-hour full report. Consultation closed in April 2026 and no bill has been introduced, so these remain proposals.
What each rule asks for, and what EASMLens shows you
| Rule | What it asks for | What EASMLens shows you |
|---|---|---|
| MCSS Standard 3 | Inventory of externally facing systems; owners (CMM3); continuous change monitoring (CMM4) | A live inventory of internet-facing assets with change history, ready to assign owners |
| MCSS Standard 5 | Suggested two-day patching for critical issues on external-facing systems | Which exposed services carry known critical CVEs, so the two-day clock starts on the right systems |
| PSR INFOSEC 1.1 | Identify and inventory ICT systems | Discovery of systems missing from the register, including supplier-hosted ones |
| SGE Framework | DMARC reject, SPF -all, DKIM, MTA-STS enforce, TLS-RPT on every domain | Pass or fail for each check on every domain we attribute to you, including non-sending domains |
Reporting clocks
Privacy Act 2020 (notifiable breach)
As soon as practicable to the Privacy Commissioner and affected people
RBNZ-regulated entities
Material cyber incidents within 72 hours
Proposed critical infrastructure regime (not law)
24-hour early warning, 72-hour full report
Questions for the board
- 1Will every one of our domains, including parked and non-sending ones, pass the SGE checks when monitoring begins in October 2026?
- 2Is our asset inventory at MCSS level 3 or 4, and does it include supplier-hosted portals that hold customer or patient data?
- 3If the critical infrastructure proposals become law, could we give a 24-hour early warning and show our internet-facing asset register on request?
How EASMLens supports these obligations
- Continuous discovery of the externally facing estate that MCSS Standard 3 scopes in
- Change detection that supports the continuous monitoring expected at MCSS level 4
- Secure Government Email readiness: SPF, DKIM, DMARC, MTA-STS, TLS-RPT and DNSSEC graded per domain
- Supplier exposure views for agencies and for companies that supply government
EASMLens discovers your attack surface from DNS, certificate transparency, internet-wide scan datasets and public records, then runs non-destructive checks against the assets in your scope. It never attempts exploitation. It provides discovery, monitoring and evidence. It does not certify an organisation against any framework, and no product can.
Frequently asked questions
- Do the Minimum Cyber Security Standards apply to private companies?
- They apply directly to mandated government agencies. Suppliers to those agencies often receive equivalent requirements through contracts, so check your contract terms rather than assuming you are out of scope.
- Is the NZISM a legal requirement?
- No. The NZISM states that compliance is not required as a matter of law. The obligations that bind agencies come through the PSR, the MCSS mandate and Cabinet directives.
- Does New Zealand have a law like Australia’s SOCI Act?
- Not yet. A regime was proposed in February 2026 and consultation closed in April 2026, but no bill has been introduced.
- How does EASMLens help with the Secure Government Email deadline?
- It discovers the domains attributed to your organisation, including ones that no longer send mail, and grades each against the SGE controls so you can fix gaps before central monitoring does.
Related guides
Primary sources
- Minimum Cyber Security Standards (NCSC)
- PSR Information Security
- Secure Government Email Framework (DIA)
- Critical infrastructure discussion document (DPMC, Feb 2026)
- Manage My Health inquiry (OPC)
Regulatory content reviewed on . General information only, not legal advice.