New Zealand has a new cyber security baseline
For years the NCSC’s Critical Controls helped businesses focus on the security measures that made the biggest difference. They served us well. But the way we work has changed a lot: cloud services, working from home, Microsoft 365, phones and tablets, AI tools and much smarter attackers. A checklist of individual controls doesn’t fit the variety of setups businesses run today.
So the NCSC has introduced new Minimum Cyber Security Standards. They aim to:
- set a modern baseline for cyber security
- focus on security outcomes rather than particular technologies
- work for businesses of all sizes
- line up better with international frameworks
- encourage ongoing improvement instead of ticking a fixed list
Put simply, the question has moved from “have I put these controls in?” to “can I show my business is actually achieving these security outcomes?” That fits neatly with the SMB1001 framework approach we use with our clients.
What does it mean for you?
For most businesses the basics haven’t changed. The common-sense protections that cut risk five years ago still matter today. What’s changed is how you measure success. Instead of ticking boxes, ask whether you can confidently answer questions like:
- Can only the right people get into our systems?
- Are our devices and software kept up to date?
- Could we get our data back if something went wrong?
- Would we know if something suspicious happened?
- Can our staff spot a cyber threat?
If any answer is “I’m not sure”, that’s usually where to start.
What’s in the standards?
The wording is different from the old Critical Controls, but the standards cover much the same ground.
1. Identity and access. The right people get into the right systems, and nobody else does. That means MFA, strong passwords, keeping admin access to a minimum and removing access promptly when people leave. Most successful attacks today start with a compromised account, so this is one of the most important areas of all.
2. Secure devices and systems. Every laptop, desktop, phone and server is a possible way in. Keep them updated, apply security patches, run endpoint protection and replace software that’s no longer supported. It’s always easier to prevent a problem than to clean one up.
3. Data protection and backups. Know what data you hold, protect the sensitive stuff, keep reliable backups and test that you can restore them. Having backups isn’t enough, you need to know they’ll work on the day you need them.
4. Monitoring and response. Nobody can promise they’ll never have an incident. What counts is how quickly you spot it and deal with it: monitoring for suspicious activity, reviewing alerts, having an incident response plan and knowing who to call. The sooner you find it, the smaller the damage.
5. Security awareness. Your people are still a big part of your defence. Staff should know how to spot phishing, report anything suspicious, handle sensitive information properly and follow your security policies. Cyber security isn’t just IT’s job any more, it’s everyone’s.
So are the old Critical Controls dead?
Not at all. Most of what they promoted is still at the heart of good security. What’s changed is the framework around it. Think of building standards: the old approach described a lot of the materials and methods, while the new one focuses on the result (a safe, sound building) and gives you more flexibility in how you get there.
In practice, the to-do list looks very familiar: turn on MFA, keep systems updated, back up your data, train your staff and watch for threats. Those basics still give you the biggest drop in risk.
What should you do next?
The new standards are a good excuse to take a fresh look at where you stand. Ask yourself:
- Do we know where our biggest cyber risks are?
- Are we relying on old processes?
- When did we last test a restore from backup?
- Is MFA on everywhere it should be?
- Would we know if an attacker got in?
Work through those and you’ll usually find a few improvements that pay off straight away. If you’re not sure how your business measures up, we’re happy to help you see where you are, spot the gaps and build a practical, jargon-free plan. You can also read more about our cyber security services.
Want to know how you measure up against the new NCSC standards? Book a free health check, or call us on 0800 688 768.