Cyber protection of critical infrastructure is 'priority work' but taking at least a year

Government officials are working on policies to strengthen cyber protection of critical infrastructure more than seven months after consultations closed."This remains priority work," they told RNZ this week.They are working through submissions to refine policy options, after the February-April public consultation."Our intention is to provide advice to ministers early in the next term of government."Friday's Microsoft Outlook outage has sparked fresh questions about New Zealand's vulnerability to global technology glitches and whether government was doing enough."From a cyber security perspective, the government needs to be much more engaged," said frequent critic Don Christie of Catalyst IT.Other countries moveIn early 2026, the officials laid out two new proposed categories of infrastructure that could be subject to mandatory minimum requirements to enhance cyber security and resilience.Official documents said critical national infrastructure was "increasingly vulnerable to cyber attack"."Current regulatory settings are not designed to drive a consistent uplift in cyber security across the critical infrastructure system".It was acknowledged New Zealand's approach was not keeping pace with other countries.This week, Australia flagged changes to criminal law to crack down on future breaches by artificial intelligence companies, after a frontier artificial intelligence agent hacked government systems for sensitive information in OpenAI tests.The European Union has mandated stringent cyber security measures for operators of critical infrastructure since 2024.The EU has also moved to boost the ways consumers and businesses determine which products are cybersecure, with more measures coming in two months ago.'Priority work'The government's 'Enhancing the cyber security of critical infrastructure' work revolves around a public consultation that ran from February to April."Submissions have since been worked through to refine policy options," the Department of Prime Minister and Cabinet said.It said the 2026 submissions from the public would be shared in due course. However, the website carries submissions from three years ago."Our intention is that submissions would be published on the DPMC website around the same time in 2027."Big new threats in monthsSince the consultation in early 2026, the threats globally and here have escalated rapidly, and morphed greatly, with the advent of frontier AI models that have launched unauthorised, autonomous swarm attacks on government and commercial targets in testing."The timeline is not years, it is months."In New Zealand, the National Cyber Security Centre said that, by early 2027, "malicious actors may have access to advanced AI capabilities currently available only through leading frontier AI models".Attacks could occur with little warning and organisations should prepare now, it said in September.Early 2027 co-incides with when some policy on enhancing cyber security for critical infrastructure might emerge.Concrete achievementsThe proposals have envisaged "a minimum level of cyber risk management by all critical infrastructure entities" and effective management of cyber threats affecting national security.In addition, a category of critical infrastructure of national significance (CINS) could have additional obligations beyond the minimum requirements.As of early 2026, the documents said, "Cyber risks are generally not well understood or collectively managed to a consistent level across New Zealand's critical infrastructure system".The critical infrastructure work was signed off by Christopher Luxon as national security and intelligence minister. It is part of a cyber security strategy 2026-2030 the government put out in February.RNZ asked officials what concrete achievements there had been."Alongside work to explore options for mandatory measures to improve cyber resilience and reporting, there are multiple streams of work underway," responded the DPMC, listing improving incident reporting and advice, more practical guidances and support to critical infrastructure providers, and expanding government collaboration with industry partners to prevent, detect and respond to malicious cyber activity.