- Albania
- Angola
- Antigua and Barbuda
- Argentina
- Australia
- Austria
- Azerbaijan
- Bahrain
- Bangladesh
- Belgium
- Bosnia and Herzegovina
- Botswana
- Brazil
- Canada
- Chile
- China
- Comoros
- Cyprus
- Czech Republic
- Dominican Republic
- Egypt
- Estonia
- Georgia
- Ghana
- Haiti
- Iraq
- Ireland
- Italy
- Jordan
- Kazakhstan
- Kiribati
- Kuwait
- Kyrgyzstan
- Latvia
- Lebanon
- Libya
- Lithuania
- Mexico
- Micronesia (Federated States of)
- Moldova (Republic of)
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Nauru
- Netherlands
- Nigeria
- North Macedonia
- Oman
- Panama
- Poland
- Portugal
- Qatar
- Rwanda
- Saudi Arabia
- Serbia
- Singapore
- Slovakia
- Solomon Islands
- Tajikistan
- The Bahamas
- Togo
- Tonga
- Tunisia
- Turkmenistan
- Ukraine
- United Kingdom
- United States
- Uruguay
- Uzbekistan
- Vanuatu
- Zimbabwe
RANKING TIMELINE
New Zealand
| Rank | Country | National Cyber Security IndexNCSI | Digital developmentISD | DifferenceDif | ||
|---|---|---|---|---|---|---|
| 45. | New Zealand | 55.00 | 79.24 | -24.24 | ||
STRATEGIC CYBERSECURITY INDICATORS
-
1. CYBERSECURITY POLICY915
-
1.1. High-level cybersecurity leadership33Criteria
The country has appointed governmental leadership responsible for cybersecurity at the national level.
Accepted referencesLegal act, national strategy, official statutes or terms of reference, or official website
-
1.2. Cybersecurity policy development33Criteria
There is a competent entity in the central government to whom responsibility is assigned for national cybersecurity strategy and policy development.
Accepted referencesLegal act, official statute or terms of reference, or official website
-
1.3. Cybersecurity policy coordination03Criteria
The country has a regular official format for cybersecurity policy coordination at the national level.
Accepted referencesLegal act, official statute or terms of reference, or official website
-
1.4. National cybersecurity strategy33Criteria
The central government has established a national-level cybersecurity strategy defining strategic cybersecurity objectives and measures to improve cybersecurity across society.
Accepted referencesValid official document
-
1.5. National cybersecurity strategy action plan03Criteria
The central government has established an action plan to implement the national cybersecurity strategy.
Accepted referencesCurrent official document, legal act, or official statement
-
-
2. GLOBAL CYBERSECURITY CONTRIBUTION66
-
2.1. Cyber diplomacy engagements33Criteria
The government contributes to international or regional cooperation formats dedicated to cybersecurity and cyber stability. (The indicator is limited to strategic-level cooperation; operational-level incident response cooperation and cross-border law enforcement cooperation are addressed separately under other indicators.)
Accepted referencesOfficial website of the organisation or cooperation format, official statement or contribution
-
2.2. Commitment to international law in cyberspace11Criteria
The country has an official position on the application of international law, including human rights, in the context of cyber operations.
Accepted referencesOfficial document or statement, international indexes
-
2.3. Contribution to international capacity building in cybersecurity22Criteria
The country has led or supported cybersecurity capacity building for another country in the past three years.
Accepted referencesOfficial website or project document
-
-
3. EDUCATION AND PROFESSIONAL DEVELOPMENT810
-
3.1. Cyber safety competencies in primary education22Criteria
Primary education curricula in the public education system include cyber safety (online safety, computer safety) competencies.
Accepted referencesOfficial curriculum or official report
-
3.2. Cyber safety competencies in secondary education02Criteria
Secondary education curricula in the public education system include cyber safety (online safety, computer safety) competencies.
Accepted referencesOfficial curriculum or official report
-
3.3. Undergraduate cybersecurity education22Criteria
At least one undergraduate education programme is available in the country to train students in cybersecurity.
Accepted referencesAccredited study programme
-
3.4. Graduate cybersecurity education33Criteria
At least one cybersecurity education programme is available in the country at the graduate level.
Accepted referencesAccredited study programme
-
3.5. Association of cybersecurity professionals11Criteria
A professional association of cybersecurity specialists, managers, or auditors exists in the country.
Accepted referencesOfficial website
-
-
4. CYBERSECURITY RESEARCH AND DEVELOPMENT04
-
4.1. Cybersecurity research and development programmes02Criteria
A cybersecurity research and development (R&D) programme or institute exists and is recognised and/or supported by the government.
Accepted referencesOfficial programme or official website
-
4.2. Cybersecurity doctoral studies02Criteria
An officially recognised PhD programme exists accommodating research in cybersecurity.
Accepted referencesOfficial programme or official website
-
PREVENTIVE CYBERSECURITY INDICATORS
-
5. CYBERSECURITY OF CRITICAL INFORMATION INFRASTRUCTURE312
-
5.1. Identification of critical information infrastructure03Criteria
There is a framework or a mechanism to identify operators of critical information infrastructure.
Accepted referencesLegal or administrative act
-
5.2. Cybersecurity requirements for operators of critical information infrastructure03Criteria
Operators of critical (information) infrastructure are required to assess and manage cyber risks and/or implement cybersecurity measures.
Accepted referencesLegal act, or mandatory cybersecurity framework or standard
-
5.3. Cybersecurity requirements for public sector organisations33Criteria
Public sector organisations are required to assess and manage cyber risks and/or implement cybersecurity measures.
Accepted referencesLegal or administrative act, mandatory cybersecurity framework or standard
-
5.4. Competent supervisory authority03Criteria
A competent authority has been designated and allocated powers to supervise the implementation of cyber/information security measures.
Accepted referencesLegal act or official website
-
-
6. CYBERSECURITY OF DIGITAL ENABLERS412
-
6.1. Secure electronic identification02Criteria
A national electronic identification solution exists that allows for officially recognised and secure electronic identification of natural and/or legal persons.
Accepted referencesLegal act, nationally recognised identification scheme, or official website
-
6.2. Electronic signature22Criteria
A nationally recognised and publicly available solution exists to issue secure and legally binding electronic signatures.
Accepted referencesLegal act or official website
-
6.3. Trust services02Criteria
Trust services (e.g. digital certificates, timestamps, private key management service) are regulated, at least for use in the public sector.
Accepted referencesLegal act or official website
-
6.4. Supervisory authority for trust services02Criteria
An independent authority has been designated and given the power to supervise trust services and trust service providers.
Accepted referencesLegal act or official website
-
6.5. Cybersecurity requirements for cloud services22Criteria
Requirements are established for the secure use of cloud services in government and/or public sector organisations.
Accepted referencesLegal or administrative act, cybersecurity framework or standard
-
6.6. Supply chain cybersecurity02Criteria
Requirements are established to identify and manage cybersecurity risks through the ICT supply chain.
Accepted referencesLegal act or official website
-
-
7. CYBER THREAT ANALYSIS AND AWARENESS RAISING912
-
7.1. Cyber threat analysis33Criteria
A government entity has been assigned the responsibility for national-level cybersecurity and/or cyber threat assessments.
Accepted referencesLegal act, statute, or official website
-
7.2. Public cyber threat reports33Criteria
Public cyber threat reports and notifications are issued at least once a year.
Accepted referencesOfficial website, official social media channel, or public report
-
7.3. Public cybersecurity awareness resources33Criteria
Public authorities provide publicly available cybersecurity advisories, tools, and resources for users, organisations, and ICT and cybersecurity professionals.
Accepted referencesOfficial website, public advisories
-
7.4. Cybersecurity awareness raising coordination03Criteria
There is an entity with the clearly assigned responsibility to lead and/or coordinate national cybersecurity awareness activities.
Accepted referencesLegal act, official document, or official website
-
-
8. PROTECTION OF PERSONAL DATA44
-
8.1. Personal data protection legislation22Criteria
There is a legal act for personal data protection that is applicable to the protection of data online or in digital form.
Accepted referencesLegal act
-
8.2. Personal data protection authority22Criteria
An independent public supervisory authority has been designated and allocated powers to supervise personal data protection.
Accepted referencesLegal act or official website
-
RESPONSIVE CYBERSECURITY INDICATORS
-
9. CYBER INCIDENT RESPONSE1114
-
9.1. National incident response capacity33Criteria
There is a CERT designated with nationwide responsibilities for cyber incident detection and response.
Accepted referencesLegal act or official website
-
9.2. Incident reporting obligations33Criteria
Operators of critical information infrastructure and/or government institutions are obliged to notify the designated competent authorities about cyber incidents.
Accepted referencesLegal act or official website
-
9.3. Cyber incident reporting tool22Criteria
A publicly available official resource is provided for notifying competent authorities about cyber incidents.
Accepted referencesOfficial website
-
9.4. Single point of contact for international cooperation03Criteria
The government has designated a single point of contact for international cybersecurity cooperation.
Accepted referencesLegal act or official website
-
9.5. Participation in international incident response cooperation33Criteria
The national cyber incident response team (CSIRT/CERT/CIRT) participates in international or regional cyber incident response formats.
Accepted referencesOfficial website or official document
-
-
10. CYBER CRISIS MANAGEMENT29
-
10.1. Cyber crisis management plan22Criteria
The government has established a crisis management plan for large-scale cyber incidents.
Accepted referencesLegal act or official website
-
10.2. National cyber crisis management exercises03Criteria
Regular interagency cyber crisis management exercises or crisis management exercises with a cyber component are arranged at the national level at least every other year.
Accepted referencesExercise document, official website, or press release
-
10.3. Participation in international cyber crisis exercises02Criteria
The country participates in an international cyber crisis management exercise at least every other year.
Accepted referencesExercise document/website or press release
-
10.4. Operational crisis reserve02Criteria
A mechanism for engaging reserve support has been established to reinforce government bodies in managing cyber crises.
Accepted referencesLegal act or official website
-
-
11. FIGHT AGAINST CYBERCRIME816
-
11.1. Cybercrime offences in national law33Criteria
Cybercrime offences are defined in national legislation.
Accepted referencesLegal act
-
11.2. Procedural law provisions03Criteria
Legislation defines the powers and procedures for cybercrime investigations and proceedings and for the collection of electronic evidence.
Accepted referencesLegal act
-
11.3. Ratification of or accession to the Convention on Cybercrime02Criteria
The country has ratified or acceded to the Council of Europe (CoE) Convention on Cybercrime.
Accepted referencesLegal act on Convention ratification or accession, website of the CoE Treaty Office
-
11.4. Cybercrime investigation capacity33Criteria
Law enforcement has a specialised function and capacity to prevent and investigate cybercrime offences.
Accepted referencesLegal act or official website
-
11.5. Digital forensics capacity22Criteria
Law enforcement has a specialised function and capacity for digital forensics.
Accepted referencesLegal act, statute, official document, or official website
-
11.6. 24/7 contact point for international cybercrime03Criteria
The government has designated an international 24/7 point of contact for assistance on cybercrime and electronic evidence.
Accepted referencesOfficial website, legal act or statute
-
-
12. MILITARY CYBER DEFENCE26
-
12.1. Military cyber defence capacity02Criteria
Armed forces have designated units responsible for the cybersecurity of military operations and/or for cyber operations.
Accepted referencesLegal act, statute, other official document or official website
-
12.2. Military cyber doctrine02Criteria
The tasks, principles, and oversight of armed forces for military cyber operations are established by official doctrine or legislation.
Accepted referencesLegal act, official doctrine, or official website
-
12.3. Military cyber defence exercises22Criteria
Armed forces have conducted or participated in a cyber defence exercise or an exercise with a cyber defence component in the past three years.
Accepted referencesOfficial website or official document
-