CERT NZ

CERT NZ
Name	Computer Emergency Response Team New Zealand
Formed	2014
Jurisdiction	New Zealand
Headquarters	Wellington
Parent agency	National Cyber Security Centre

CERT NZ

CERT NZ is New Zealand’s national computer emergency response team, responsible for coordinating responses to cybersecurity incidents, providing threat intelligence, and advising organisations and the public on digital resilience. It operates within the national cybersecurity architecture alongside agencies and private-sector partners to detect, mitigate, and recover from cyber threats affecting critical infrastructure, businesses, and citizens. The organisation engages in incident handling, vulnerability disclosure, public guidance, and international collaboration to enhance New Zealand’s cyber posture.

History

CERT NZ was established in the mid-2010s as part of a national effort to centralise incident response capabilities and align with international cyber-defence practices seen in agencies such as United States Computer Emergency Readiness Team, CERT-EU, and Australian Cyber Security Centre. Early development drew on frameworks like the NIST Cybersecurity Framework and lessons from incidents including the WannaCry cyberattack and the NotPetya cyberattack, prompting legislative and policy discussions in bodies such as the New Zealand Parliament and reviews by the National Cyber Security Centre. CERT NZ evolved through organisational shifts, incident-driven expansions, and partnerships with telecommunications companies like Spark New Zealand and financial institutions including ANZ Bank (Australia) to scale operational capacity.

Organisation and governance

CERT NZ is situated within New Zealand’s national cybersecurity ecosystem and coordinates with the National Cyber Security Centre (NCSC), regulatory agencies such as the Commerce Commission (New Zealand), and law-enforcement bodies like the New Zealand Police. Governance structures reflect accountability to ministers and oversight mechanisms comparable to those governing entities such as the Government Communications Security Bureau and public-sector agencies operating from Wellington. Operational leadership includes directors with backgrounds in incident response, intelligence analysis, and public policy, and governance frameworks emphasise compliance with standards like the ISO/IEC 27001 family and data-protection regimes influenced by legislation such as the Privacy Act 2020 (New Zealand).

Services and functions

CERT NZ provides services including incident reporting triage, advisory publications, vulnerability handling, and threat intelligence dissemination, drawing on methodologies used by organisations like FIRST (Forum of Incident Response and Security Teams) and ENISA. It issues advisories on malware families such as Emotet and TrickBot, and provides guidance for sectors represented by bodies like the Electricity Authority (New Zealand), Health New Zealand, and the Ministry of Education (New Zealand). CERT NZ maintains situational awareness through indicators of compromise sharing, runs vulnerability disclosure processes akin to platforms used by Microsoft and Google, and offers tooling recommendations referenced by providers such as Cisco Systems and Fortinet.

Incident response and operations

Operationally, CERT NZ handles incident intake, coordination, and response playbooks based on best practices from SANS Institute and incident methodologies similar to those promulgated by MITRE ATT&CK. Responses have addressed large-scale phishing campaigns, ransomware outbreaks affecting organisations like utilities and universities, and supply-chain compromises reminiscent of incidents involving SolarWinds. The team coordinates cross-sector responses with critical infrastructure operators, internet service providers such as Vodafone New Zealand, and international CERTs including CERT-EU and the United States Computer Emergency Readiness Team. CERT NZ employs digital forensics, threat-hunting, and recovery guidance, and escalates criminal matters to the New Zealand Police Cybercrime Unit when necessary.

Public awareness and education

CERT NZ runs public-awareness campaigns, publishes guidance on topics like multi-factor authentication, password hygiene, and secure software updates, and partners with educational institutions such as the University of Auckland and polytechnics to promote cyber skills development. Outreach includes resources for small businesses, iwi organisations, and community groups, and coordination with initiatives led by the Ministry of Business, Innovation and Employment (New Zealand) and workforce programmes associated with Tech Alliance New Zealand. Training and exercises employ scenarios similar to those used by the Cybersecurity and Infrastructure Security Agency and professional development ties to certifications from bodies like (ISC)² and CompTIA.

Partnerships and international cooperation

CERT NZ engages in bilateral and multilateral cooperation with international counterparts including CERT-EU, United States Computer Emergency Readiness Team, Australian Cyber Security Centre, and regional partners in the Pacific Islands Forum. It participates in information-sharing networks such as FIRST (Forum of Incident Response and Security Teams) and coordinates with private-sector vendors like Microsoft and cloud providers including Amazon Web Services for threat intelligence and mitigation. The organisation is active in capacity-building initiatives across the Pacific, collaborating with development agencies and regional CERTs to bolster resilience against cyber incidents and contribute to multinational exercises alongside entities like INTERPOL and APNIC.

Category:Cybersecurity in New Zealand