Security Solution Consultants (SSC) runs the cyber security audit Hamilton and Waikato organisations commission when they need an independent, evidence-based answer to two questions: are our controls working, and could we show a regulator, customer or board that they are? We audit organisations in Hamilton, Waikato, and across the wider region from our base in Tarneit, Victoria 3029, doing most of the work remotely and coming on site for processing plants, OT, data centres and findings walkthroughs. Each audit is measured against the requirement you actually face: the Privacy Act 2020, HISO 10029, ISO/IEC 27001, FSSC 22000, NZISM or a customer’s contract.
Who in the Waikato is asking for audits
Health providers and their suppliers. The Waikato health sector has been through two significant incidents: the 2021 ransomware attack on Waikato DHB and the access, on 28 September 2022, to a third-party server used by Pinnacle Midlands Health Network. Practices, provider groups and health technology firms use audits to test the controls those incidents brought into focus: supplier access, logging and incident readiness.
New water organisations. IAWAI Flowing Waters, with about 90,700 connections, and Waikato Waters Ltd began operating on 1 July 2026. A baseline audit in the first year shows each board what systems and risks it started with and where to invest first.
Dairy and food processors. Processors working under MPI Risk Management Programmes and FSSC 22000 certification already run internal audits. Adding information security and OT to that cycle makes sense now that production and verification records are digital.
Agritech and technology manufacturers. Hamilton’s agritech firms and security technology manufacturers sell to customers who send security questionnaires and expect an ISO 27001 internal audit or SOC 2 readiness evidence behind the answers.
Councils. Hamilton City, Waikato Regional, Waikato District and Waipā District councils hold rates, consent and customer data. Their audit and risk committees have a ready benchmark in the Auditor-General’s April 2025 report Mind the gap, which found most audited organisations carrying more residual cyber risk than their appetite.
Compliance audit, technical review or penetration test
Decide which of these you need before anyone scopes the work.
- Compliance audit: checks your controls against a named yardstick, such as the Privacy Act, HISO 10029, ISO 27001 or a contract, and produces findings that a third party can rely on.
- Technical review: inspects how systems are set up, including firewall rules, remote access, administrator accounts, patching and backups, and shows where the weak points are without reference to any standard.
- Penetration test: an authorised attack simulation within agreed rules, showing what an intruder could reach today.
A regulator, certification body or customer asking for assurance usually wants the first. A board asking whether a ransomware attack like the one in 2021 could happen here usually needs the first two together. If a penetration test is what you need, see our penetration testing and security testing services.
How a Waikato audit runs
Scope. Entities, sites, systems, suppliers and the standard. For processors and water organisations we decide early whether OT is in or out, because that changes the whole plan.
Documents. Policies, the risk register, asset lists, network diagrams, supplier contracts, incident response plans and last year’s findings. Missing documents become findings.
Control testing. We sample evidence: privileged account lists, log review records, restore tests, supplier access approvals, and proof that the incident response plan has been exercised.
Interviews. Short sessions with control owners, IT providers, plant engineers and the privacy officer, to compare what is written with what happens.
Report. Rated findings, each tied to a requirement, with fixes your team or IT provider can act on, presented in a walkthrough.
Standards we audit against in the Waikato
- Privacy Act 2020. A privacy audit of collection, storage, access, retention and breach response, including the IPP3A notice duty from 1 May 2026 and the Biometric Processing Privacy Code 2025 where fingerprint or face systems are used.
- HISO 10029. The core standard with HISO 10029.2 or 10029.3 segment guidance for providers, and HISO 10029.4:2025 for suppliers.
- ISO/IEC 27001:2022. Internal audits under clause 9.2 and pre-certification readiness. See ISO 27001 implementation and advisory.
- ISO 22000 and FSSC 22000. Internal audits for processors, including food defence and the record systems that support your RMP, through our ISO 22000 consulting.
- NZISM v3.9 and the PSR. For suppliers whose government contracts reference GOV 5 or particular NZISM controls.
- SOC 2 readiness. Testing against the trust services criteria before a licensed CPA firm’s examination. See SOC 2 readiness consulting.
- Incident readiness review. Logging and monitoring, exercises, segmentation and privileged access, the four areas the InPhySec review recommended, tested against your environment and linked to our incident response service.
Report, timeframe and fees
The report. Each finding states the requirement, what we saw, why it matters and what to do, with a priority and an owner. A short summary for directors and trustees comes first. We present it in person or online, and can load the findings into GRCLens for tracking.
Timeframe. Fieldwork for one organisation with a clear scope is usually measured in days. Multi-site processors and OT add time, and so does slow evidence.
Fees. We price the agreed scope as a fixed fee before work starts. Narrow scopes cost less, which is a good reason to audit to the exact requirement in front of you. Certification bodies charge separately for their own audits.
Waikato specifics that change the scope
Water services in their first year. IAWAI Flowing Waters and Waikato Waters Ltd started on 1 July 2026. Audits need to cover any shared services or transitional arrangements, OT at treatment and pumping sites, and readiness for essential infrastructure provider duties under the Emergency Management Bill (No 2).
Third-party access in health. The 2022 access to a third-party server used by Pinnacle Midlands Health Network, which serves about 450,000 patients, shows why a health audit cannot stop at your own network. We bring IT providers, hosting firms and software vendors into scope under HISO 10029.4.
Plants, farms and distance. Dairy processing sites run OT around the clock, and many Waikato organisations operate from several rural locations. We schedule on-site days around production, test the remote access paths integrators use and check that backup and recovery work at each site, not only at head office.
Audits across the Waikato
We audit organisations throughout the region, from Hamilton to Cambridge, Te Awamutu, Matamata, Morrinsville, Huntly, Thames and Taupō. Documentation review, testing and interviews run remotely; we travel for site work. We also audit for organisations in Tauranga and Auckland.
For longer-term support, from FSSC 22000 and ISO 27001 readiness to incident response exercises, see our cyber security compliance and consulting services in Hamilton and the Waikato.
Frequently asked questions
What does a privacy audit cover for a Hamilton business?
We trace personal information from collection to deletion: what you collect and why, IPP3A notices for information received from third parties, who can access it, where it is stored, how long it is kept and how you would handle a breach. Where you use fingerprint or face systems, we also test against the Biometric Processing Privacy Code 2025. Findings are mapped to the Privacy Act 2020.
Can an audit tell us whether we would spot ransomware before it executes?
It can test the conditions that make early detection possible. We check which logs you collect, who reviews them and how often, whether alerts reach someone out of hours, and whether privileged account activity is monitored. The Waikato DHB review recommended these capabilities, and the roughly two months between infection and execution in that case shows why the detection window matters.
Our IT is outsourced. Can the audit include our managed service provider?
Yes, and for health organisations it usually should. We review the contract, the provider’s access to your systems, how that access is approved and logged, and what evidence the provider can share, such as an ISO 27001 certificate or SOC 2 report. Under HISO 10029.4:2025, outsourced providers and their sub-contractors are expected to meet supplier requirements too.
How do you audit a dairy processing site that runs around the clock?
We plan around the season and the shift pattern. OT work is mainly observation, configuration and architecture review, and conversations with engineers and operators, not intrusive scanning of live control systems. Anything that could touch production is agreed in advance with the site manager. We do this part on site, usually in one visit combined with interviews.
We are a new water services organisation. What should our first audit cover?
Start with a baseline: governance and risk ownership, the asset and system inventory, OT at treatment and pumping sites, contractor remote access, backup and recovery, incident response and any shared services still provided by others. That gives the board its starting position and a prioritised plan as essential infrastructure provider duties under the Emergency Management Bill (No 2) approach.
Does an FSSC 22000 internal audit from SSC replace the certification body’s audit?
No. The scheme requires you to run internal audits, and the certification body then performs its own independent audit. Our internal audit gives you evidence that the requirement is met and finds problems before the certification body does. We can combine it with an information security review, so production and verification records are tested in the same visit.
How quickly can a Waikato audit start?
Usually once the scope is agreed and the first documents arrive. We send an evidence request list with the proposal so your team can start gathering material straight away. Fieldwork moves at the pace evidence is supplied, so naming one internal coordinator, often the IT or quality manager, is the simplest way to keep the audit on schedule.
Next step
Share what prompted the audit, such as a customer clause, a HISO 10029.4 request, a certification timetable or a board question about ransomware, and we will come back with a scope and a fixed fee. Contact us or email info@secsolutionshub.com.
