NCSC completes improvements post-IPAC cyber activity review

The NCSC has implemented all the improvements identified by a review of malicious cyber activity targeting the Inter-Parliamentary Alliance on China (IPAC).

Lisa Fong, Deputy Director-General of Cyber Security at GCSB, announced that the National Cyber Security Centre (NCSC) swiftly acted on the recommendations following the review conducted in July. "I'm pleased to confirm that we have put in place measures to address all recommendations outlined in the initial review," Ms Fong stated.

The improvements involved updating the NCSC's internal processes after consulting relevant stakeholders. The new standards and guidance are intended to prevent the recurrence of such concerns in the future.

Advice and guidance for New Zealanders identified as 'high profile individuals' were also published on the NCSC website, adhering to the review's fourth recommendation. Ms Fong elaborated, "These series of actions help to ensure the NCSC's work continues to be both focused on the most significant threats, but also those whom those threats affect."

While these actions mark the completion of the initially recommended improvements, the NCSC continues to seek further enhancements in its cyber security response. "This implementation of specific recommendations is not the end of the NCSC's ongoing work to ensure its response to cyber incidents reduces harm for New Zealanders," Ms Fong noted.

She further asserted the commitment to ongoing development: "We are committed to identifying opportunities for improvement in our practices and procedures and implementing these where we have the ability to do so."

Ms Fong initiated the review of the NCSC's practices in May, following concerns regarding the handling of reports of malicious cyber activity targeting IPAC members. The review concluded in July, identifying a need for the NCSC to consider the broader implications of cyber security incidents beyond the technical response. It examined how the NCSC responds to reports of malicious cyber activity involving foreign state-sponsored actors.