Critical infrastructure cyber policy still in progress, officials say
Government officials are working on policies to strengthen the cyber protection of New Zealand's critical infrastructure, more than seven months after public consultation closed. Critical infrastructure is the essential systems the country relies on to function.
Officials told RNZ this week that enhancing the cyber security of critical infrastructure "remains priority work". They said they are working through submissions from the public consultation held between February and April, to refine the policy options.
In early 2026, officials proposed two new categories of infrastructure that could be subject to mandatory minimum cyber security and resilience requirements. Officials intend to give ministers advice on critical infrastructure cyber security early in the next term of government.
The Department of Prime Minister and Cabinet said submissions from the 2026 consultation would be published on its website around the same time in 2027.
On Friday, a Microsoft Outlook outage prompted fresh questions about New Zealand's vulnerability to global technology glitches, and whether the government was doing enough. Don Christie of Catalyst IT said that, from a cyber security perspective, the government needs to be much more engaged.
The European Union has required strict cyber security measures from operators of critical infrastructure since 2024.
New Zealand's National Cyber Security Centre said that by early 2027, malicious actors may have access to advanced AI capabilities currently available only through the most advanced AI systems.
