Security Solution Consultants (SSC) delivers cyber security services Tauranga exporters, growers, port users and councils can put in front of a buyer, an insurer, a regulator or their own board. We are a cyber security and governance, risk and compliance (GRC) consultancy based in Tarneit, Victoria 3029. We work remote-first across New Zealand and travel to the Bay of Plenty when a workshop, a site walk or a findings session is better done in the room. We work out which obligations really apply, close the gaps that matter, prepare you for certification and audit, and keep the evidence in one place.

Tauranga’s economy is wired into other people’s supply chains. The Port of Tauranga moved 25.3 million tonnes and 1,208,252 TEU in FY25, about a third of New Zealand’s cargo by weight and 48% of its containerised exports. Zespri is headquartered at Mount Maunganui, and the Bay of Plenty grows about 80% of the country’s kiwifruit. Security questions here usually come from somewhere along that chain: an overseas customer, a shipping line, a food safety auditor or a council procurement team.

Which rules apply in the Bay of Plenty

Which cyber security obligations apply to Bay of Plenty organisations, by type of organisation
Most Bay of Plenty organisations sit in more than one row: privacy applies to everyone, and contracts and sector rules add the rest.

New Zealand has no single cyber security statute for private business. What applies depends on what you are and who you sell to, and most organisations fit more than one of the groups below.

Every organisation that holds personal information. The Privacy Act 2020 applies regardless of size. Its information privacy principles now include IPP3A, in force from 1 May 2026, which requires reasonable steps to make sure people know when you have collected their personal information from someone else rather than from them. Notifiable privacy breaches go to the Office of the Privacy Commissioner, ideally within 72 hours, and failing to notify can bring a fine of up to $10,000. For a packhouse receiving seasonal worker details from a labour contractor, IPP3A is a practical change to onboarding, not a legal footnote.

Councils and council-controlled organisations. Tauranga City Council, the Bay of Plenty Regional Council (Toi Moana) and Western Bay of Plenty District Council are not among the agencies mandated to follow the Protective Security Requirements, yet they hold large volumes of ratepayer data and run water and transport services. The Auditor-General’s April 2025 report, Mind the gap: Governing cyber security risks, found that most audited organisations carried more residual cyber risk than their stated appetite and were not testing incident response enough: a useful checklist for any committee in the region.

Suppliers to central government. Public service departments, Police, NZDF, the NZSIS and the Parliamentary Counsel Office must follow the PSR and the New Zealand Information Security Manual. Requirement GOV 5 carries security expectations into supplier contracts, so a Bay of Plenty software or logistics firm with a government customer inherits them. Under the Government Procurement Rules, 5th edition from 1 December 2025, agencies must also risk-assess any public cloud service before using it.

Health, finance and food. Suppliers to health providers are measured against HISO 10029.4:2025. Entities regulated by the Reserve Bank, and firms holding an FMA licence, must report material cyber incidents within 72 hours. Dairy and meat processors and their export chain operate under MPI Risk Management Programmes.

Critical infrastructure operators. The rules are changing; the section below explains where things stand.

Certifications Tauranga businesses ask us about

Most certification requests in the Bay of Plenty start with a customer rather than a regulator.

  • SOC 2. Freight, logistics and agritech software firms selling to North American customers are commonly asked for a SOC 2 Type 2 report. A licensed CPA firm issues the report; we get your controls, policies and evidence ready for the examination and support you through it.
  • ISO/IEC 27001. The certification exporters, post-harvest operators and freight forwarders most often hear about when they exchange shipping, customs and customer data with larger partners. An accredited certification body certifies you; we build the information security management system with you and run the internal audit first.
  • ISO/IEC 42001. AI is already part of Tauranga operations, including at the port. ISO 42001 sets up an AI management system that sits comfortably alongside the National AI Strategy and MBIE’s Responsible AI guidance of 8 July 2025, useful for any business putting AI into scheduling, fruit grading or customer service.
  • ISO 9001. Engineering, maintenance and construction firms tendering for port, council and infrastructure work commonly find ISO 9001 on the prequalification checklist, often with ISO 45001 beside it.
  • ISO 22000 and FSSC 22000. The region’s dairy manufacturing exports are worth $858 million and its horticulture exports $2.65 billion. Processors already running an MPI Risk Management Programme often add ISO 22000 or FSSC 22000 when overseas buyers want a GFSI-recognised scheme, reusing the programme’s hazard analysis and verification. FSSC 22000 has been certified in New Zealand since 2011, when Tatua became the first.
  • Critical infrastructure readiness. Port service providers, lines companies and water operators want to know what the reforms will ask of them. We provide business continuity management, energy sector security assessments and critical infrastructure and OT security training for operations staff.

Critical infrastructure in the Bay of Plenty

New Zealand does not yet have a cyber security law for critical infrastructure. The Department of the Prime Minister and Cabinet consulted on a discussion document from 27 February to 19 April 2026, and no bill has been introduced. Separately, the Emergency Management Bill (No 2) passed its third reading on 28 August 2026. Under it, today’s lifeline utilities become essential infrastructure providers, so energy, water and telecommunications operators should check how their continuity planning maps to the new framework.

The Bay of Plenty has an unusual stake in where this lands. The port carries roughly a third of national cargo by tonnes, and the Bay of Plenty Regional Council owns 54.14% of it through Quayside Holdings. A serious outage would therefore be both a national supply chain problem and a question for the region’s ratepayers.

Waiting for a bill is not a plan. The work that will count under any final regime is already clear: know which systems and suppliers keep operations running, separate operational technology from corporate IT, and rehearse running manually.

Our services in Tauranga

Port and export supply chains

In 2017 the NotPetya malware crippled the systems of Maersk, the global shipping line. Its effects reached Tauranga: Maersk vessels at the port had to be processed manually while the line’s systems were down. The cause was on the other side of the world; the disruption arrived here through a dependency.

That is still the main shape of cyber risk for the region’s exporters. A kiwifruit season moves hundreds of millions of trays (Zespri reported 2025/26 fruit sales of $5.9 billion from 248.1 million trays) through growers, packhouses, coolstores, transport operators, the port and shipping lines, each running its own systems and passing data to the next. A failure at any link, whether ransomware at a coolstore operator or an outage at a booking platform, holds up perishable fruit while the clock runs.

For Tauranga organisations in that chain, the useful work is practical:

  • A dependency map naming who you rely on for bookings, documentation, temperature monitoring and payments, and what happens if each is unavailable.
  • Manual fallback runbooks that have been rehearsed, so a team can keep loading if a portal or a shipping line’s system goes dark.
  • Contract clauses requiring partners to tell you about incidents quickly and cooperate on recovery.
  • Separation between operational technology, such as coolstore refrigeration controls, and the office network.

None of this waits on new law, and it is the kind of evidence large customers and insurers commonly ask about.

National rules every Bay of Plenty organisation should track

A handful of national settings shape most New Zealand work. IPP3A joined the Privacy Act 2020 on 1 May 2026, through the Privacy Amendment Act 2025. NZISM v3.9, published in April 2025, and the PSR set the bar for mandated agencies, and GOV 6 requires them to report incidents to the National Cyber Security Centre, which absorbed CERT NZ in 2023. The Reserve Bank has required material cyber incidents to be reported within 72 hours since 8 April 2024, and the FMA’s standard licence condition has applied the same 72 hour window since 1 July 2024. HISO 10029.4:2025, published on 6 May 2025, extends the health information security framework to suppliers, including SaaS providers, ISPs and subcontractors. The Cyber Security Strategy 2026 to 2030, released in February 2026, sets the government’s direction for the rest of the decade.

GRCLens: one set of evidence for many requests

A Tauranga exporter can face an ISO 27001 surveillance audit, a shipping partner’s security questionnaire, a privacy review and a board risk report in the same quarter. GRCLens, the GRC platform we build, maps those requirements to one shared set of controls, so evidence is collected once and reported many times.

Need an audit rather than ongoing advice?

For an independent, point-in-time view of your controls, see cyber security audit services for Tauranga and the Bay of Plenty.

Penetration testing and security testing in Tauranga

In 2017 the NotPetya malware that crippled global shipping line Maersk forced Maersk vessels at the Port of Tauranga onto manual processing. The port handles almost half of New Zealand’s containerised exports, so penetration testing in Tauranga and the Bay of Plenty is as much about the supply chain as the port itself: freight forwarders, coolstores, packhouses and exporters all connect to the same systems.

We test the web portals and APIs that growers, exporters and logistics partners use, review Microsoft 365 and cloud configuration, and run internal network tests for businesses whose coolstore and packhouse systems share a network with the office. Seasonal workforces mean many short-lived accounts, so identity and access testing matters here. OT assessments of coolstore and processing systems are passive and safety first. Secure code review and threat modelling are available for local software and agritech teams. See our penetration testing and security testing services, or a cyber security audit in Tauranga.

Frequently asked questions

Is there a cyber security law Tauranga businesses must follow?

There is no single cyber security statute for private businesses in New Zealand. The Privacy Act 2020 applies to anyone holding personal information, and sector rules add more: RBNZ and FMA 72 hour incident reporting for financial firms, HISO 10029.4:2025 for health suppliers, and NZISM and the PSR through government contracts. In practice, most Bay of Plenty firms meet their toughest requirements through customer contracts rather than legislation.

Could critical infrastructure reform affect suppliers to the Port of Tauranga?

Possibly, but nothing is settled. DPMC consulted on a critical infrastructure discussion document from February to April 2026 and there is no bill yet. What already happens is contract flow-down: large operators ask their contractors about access control, incident notification and continuity. If you maintain systems, equipment or software for a port or utility, expect those questions and keep the answers documented.

We already run an MPI Risk Management Programme. Why would a buyer want ISO 22000 too?

An RMP satisfies New Zealand’s regulator. Overseas buyers often want a certification they can compare across suppliers, commonly FSSC 22000 or ISO 22000. Much of your RMP hazard analysis, document control and verification can be reused, so the extra effort sits mostly in management system elements and the certification audit. We prepare you; an accredited certification body certifies you.

Does IPP3A change how we hire seasonal workers?

It can. Since 1 May 2026, IPP3A requires reasonable steps to make sure people know when you collect their personal information from a third party. If labour contractors, recruiters or previous employers send you details about seasonal staff, you need a way to tell those workers who holds their information and why. A short notice built into onboarding usually covers it.

Do you work on site in Tauranga or only remotely?

Most work, including document review, control testing and interviews, runs well remotely from our base in Tarneit. We travel to Tauranga and the wider Bay of Plenty when being there helps: workshops with operations staff, walking through coolstore or plant networks, physical security checks, and presenting findings to a board or committee.

How is cyber security consulting priced for a Bay of Plenty SME?

We price by scope, not by the hour. After a short discovery conversation we confirm what is driving the work, whether a buyer’s questionnaire, a certification or a board request, and give a fixed price for that scope. Narrowing the work to what the customer or regulator actually asked for is usually the biggest saving open to a smaller business.

Can SSC certify our ISO 27001 or issue our SOC 2 report?

No, and that separation protects you. ISO 27001 certification must come from an accredited certification body, and SOC 2 reports are issued by licensed CPA firms. We do the preparation: scoping, the management system or control set, internal audit, evidence and support during the external assessment. Buyers trust the result more because the preparer and the assessor are different organisations.

Next step

Tell us what prompted the question, whether a buyer’s questionnaire, a certification deadline, a council tender or a board request, and we will scope the work to that. Contact us or email info@secsolutionshub.com. We also work with organisations in Auckland, Wellington and across New Zealand.