What you need to know

• You must have protective security governance arrangements — refer to the Protective Security Requirements website.
• Websites must have a business owner who is a senior manager, and a manager and administrators.
• You must have documentation for online systems and management procedures.
• Raise concerns with your Chief Information Security Officer.
• Discuss security and privacy governance with your IT Security Manager.

Chief Security Officer

You must appoint a senior manager as the Chief Security Officer (CSO).

They're responsible for the agency protective security policy and oversight of protective security practices.

Roles and responsibilities in your organisation — Protective Security Requirements

Privacy Officer

You must appoint a Privacy Officer.

They don't need special training, but they do need to understand the 12 Privacy Principles.

What is a privacy officer? Am I required to have a privacy officer? — Office of the Privacy Commissioner

Agency Head

The agency head endorses and is accountable for information security in your agency.

Agency Head — New Zealand Information Security Manual

Chief Information Security Officer (CISO)

The CISO sets the strategic direction for information security in your agency.

Chief Information Security Officer — New Zealand Information Security Manual

Information Technology Security Managers (ITSM)

ITSM provide information security leadership and management in your agency.

Information Technology Security Managers — New Zealand Information Security Manual

System owners

System owners obtain and maintain accreditation of their systems, including directly related services such as cloud.

System owners — New Zealand Information Security Manual

System users

System users comply with information security policies and procedures in your agency.

System users — New Zealand Information Security Manual

More information

Make sure you're familiar with the NZ Cyber Security Strategy.

New Zealand's Cyber Security Strategy 2015 — Department of the Prime Minister and Cabinet

If you have any concerns about security and privacy governance, talk to your CISO.