For many years New Zealand has believed it is shielded from main security and privacy issues because it isn't the subject of mandatory reporting i.e. legislation.
Some protection is provided in business for external threats but not for a high degree of security.
This continues to undermine the efforts of the security team to ensure cohesive and effective security controls.
Small business are investing but in a way that suggests they underestimate the issues around CyberSecurity as in this report from 2020.
https://www.nzherald.co.nz/business/news/article.cfm?c_id=3&objectid=12363068
Fast forward to 2023 and the same issues exist with a threat of Security staffing being reduced due to financial pressures post Covid. Many small businesses share a security manager and rely on outsourced IT operations which may not even reside in New Zealand.
More investment is being made but there are only a finite number of experienced security professionals in the country and some are likely to migrate to better employment in e.g. Australia.
Also compliance with required legislation in the country and binding financial requirements such as PCIDSS are still not being met despite having been established since 2004.
https://securitybrief.co.nz/story/more-action-needed-to-plug-critical-gaps-in-cybersecurity
