Security Solution Consultants (SSC) runs the kind of cyber security audit Tauranga organisations can hand to a shipping partner, an overseas buyer, a lender or their own audit and risk committee and have it taken seriously. We are based in Tarneit, Victoria 3029, deliver most audit work remotely, and come to the Bay of Plenty for the parts that need a person on site. Our audits test whether the controls you describe actually operate, measured against the standard or contract that triggered the request.
Who in Tauranga is asking for audits, and why
Audit requests in the Bay of Plenty rarely begin with “we want an audit”. They begin with a question someone else has asked.
Exporters and their logistics partners. With the Port of Tauranga handling about 48% of New Zealand’s containerised exports, many of the businesses that book, pack, store and move that cargo are based here. Overseas customers and freight partners commonly send security questionnaires, and a supply chain security audit lets you answer them from one body of evidence rather than questionnaire by questionnaire.
Kiwifruit and food businesses. Zespri, headquartered at Mount Maunganui, reported 2025/26 fruit sales of $5.9 billion, and the region grows about 80% of New Zealand’s kiwifruit. Packhouses, coolstores and processors hold grower data, payment details and seasonal worker records. When a large partner asks how those are protected, an IT security audit gives a documented answer.
Councils and council-owned entities. Tauranga City Council, Toi Moana Bay of Plenty Regional Council and Western Bay of Plenty District Council answer to elected members. In its April 2025 Mind the gap report, the Auditor-General concluded that most organisations it examined held more residual cyber risk than they had agreed to accept, and had not tested incident response enough. An independent audit is how a committee finds out whether that is true at home.
Firms preparing for certification. ISO 27001 requires an internal audit before the certification body arrives. Smaller firms often bring in an outside auditor for this, because an internal audit performed by the people who built the system is hard to make independent.
Audit, assessment or penetration test?
These are three different purchases. A compliance audit asks whether your controls meet a defined yardstick, such as ISO 27001, NZISM or a buyer’s contract, and produces findings tied to specific clauses. A technical assessment looks at configuration and exposure: patch levels, administrator access, multi-factor authentication, firewall rules and internet-facing services. It tells you where you are weak, not whether you comply. A penetration test goes further and tries to exploit those weaknesses within agreed limits, giving deep evidence about a narrow target. Customers and certification bodies wanting assurance usually need the first; security teams hunting for holes want the second or third. Buying a penetration test when a buyer asked for a compliance audit is a common and expensive mismatch. If a penetration test is what you need, see our penetration testing and security testing services.
How a cyber security audit in Tauranga runs
1. Scope. We agree the entities, sites, systems, suppliers and yardstick. For a supply chain audit that includes which partners and data flows are in, the decision that moves cost more than any other.
2. Documents. Policies, risk register, asset list, supplier contracts, incident and continuity plans. For processors we also look at how Risk Management Programme records are stored, backed up and protected.
3. Control testing. We sample to see whether controls work in practice: user access reviews, backups that actually restore, multi-factor coverage, supplier offboarding and logging.
4. Interviews. The people who run the systems, including operations staff at packhouses, coolstores and depots, not only IT. We plan these around the season so busy teams are not pulled off the floor at the worst time.
5. Report. Findings rated by severity and mapped to clauses, each with an owner and a place in the fix sequence, followed by a walkthrough with the people who will do the work.
Which standard to audit against
- Your customer’s contract or questionnaire. For many exporters this is the real driver, and the scope only needs to match the clause.
- ISO/IEC 27001:2022. Internal audit or certification readiness. See ISO 27001 certification in New Zealand.
- NZISM v3.9 and the PSR. For suppliers to mandated agencies, where GOV 5 places requirements in your contract.
- HISO 10029.4:2025. For SaaS, IT and outsourced providers serving Bay of Plenty health organisations.
- Privacy Act 2020, including IPP3A. A privacy audit covering collection notices, indirect collection, breach response and, if you use fingerprint or facial recognition for site access or timekeeping, the Biometric Processing Privacy Code 2025.
- RBNZ and FMA requirements. Incident classification and the 72 hour notification path for regulated finance firms.
- SOC 2 readiness. A pre-examination review for software and logistics platforms before a licensed CPA firm issues the report. See SOC 2 readiness consulting.
- ISO 42001, ISO 9001 and ISO 22000. Internal audits of AI, quality and food safety management systems, including FSSC 22000 alongside an MPI Risk Management Programme. See ISO 42001 consulting and ISO 9001 and ISO 22000 consulting.
- Continuity and critical infrastructure readiness. Dependency mapping, manual fallback and OT separation, reviewed against the direction of the national reforms. See business continuity management.
What you get
A findings register tied to the clauses you were audited against; a plain English summary for directors or elected members; a remediation sequence that puts cheap, high value fixes first; and a session to talk it through. If you use GRCLens, findings load straight in, so next year’s audit starts from this year’s evidence.
Timing
A single-site business with a clear scope usually needs a few days of fieldwork, with the report following soon after. Multi-site packing and logistics groups, or audits that take in several suppliers, run longer. Unless you ask otherwise, we keep fieldwork away from the peak of the kiwifruit harvest, when operations staff have no time to spare.
Cost
We quote a fixed price once the scope is agreed. Scope drives the number: how many systems, sites and suppliers are in play, and which standard applies, matter far more than headcount. A short scoping conversation usually trims the work back to what was actually asked for. If certification is the goal, the certification audit is a separate fee paid to an accredited certification body.
Bay of Plenty specifics that change the scope
Your risk often lives in someone else’s system. When NotPetya hit Maersk in 2017, Maersk vessels at the Port of Tauranga had to be processed manually. For local exporters and logistics firms, an audit that ignores booking platforms, shipping line portals and freight software misses the most likely disruption, so we bring key suppliers and data flows into scope deliberately.
Seasonal workforces strain access control. Packhouses and coolstores add and remove large numbers of short-term users each season. Joiner and leaver processes, shared accounts and biometric timekeeping get extra testing, and IPP3A comes into play where worker details arrive from labour contractors.
Operational technology sits close to the office network. Coolstore refrigeration controls and grading lines are often managed from the same sites as email and accounts. We check whether they are separated and who can reach them remotely, because that is where an ordinary phishing incident can turn into a stopped operation.
Audits across the Bay of Plenty
We audit organisations in Tauranga, Mount Maunganui and Pāpāmoa, and across the wider region in Te Puke, Katikati, Whakatāne and Rotorua. Document review, control testing and most interviews run remotely, so a Te Puke packhouse receives the same method and report as a Tauranga head office, with site visits added where a walkthrough of plant or premises is needed. For ongoing advice, certification support and critical infrastructure planning, see our cyber security compliance and consulting services in Tauranga.
Frequently asked questions
What does a supply chain security audit cover for a Tauranga exporter?
It looks beyond your own network to the partners you depend on: freight software, shipping line portals, coolstore operators, payment providers and IT support. We check what your contracts require of them, how you would learn about an incident on their side, what data they hold and whether you could keep operating manually. Findings show where a partner failure would hurt most.
Is an IT security audit the same as the internal audit ISO 27001 requires?
Not necessarily. An ISO 27001 internal audit tests your management system against the standard’s clauses and the Annex A controls you selected, and must be independent of the work being audited. A general IT security audit can be broader or narrower. If certification is the goal, we scope the work to meet clause 9.2 so the certification body can rely on it.
Can you audit biometric timeclocks and site access systems?
Yes. If you use fingerprint or facial recognition for site entry or timekeeping, the Biometric Processing Privacy Code 2025 applies. It took effect on 3 November 2025, and processing already under way had until 3 August 2026 to comply. We review why biometrics are used, what workers are told, how long templates are kept and who can reach them, alongside general Privacy Act duties.
Is NZISM a sensible yardstick for a council or council-controlled organisation?
Often, yes. Councils are not among the agencies mandated to follow the PSR, but NZISM v3.9 is a detailed, publicly available New Zealand baseline that auditors and insurers recognise. A practical approach is to audit against a selected set of NZISM controls, or ISO 27001, and focus on the Auditor-General’s 2025 themes of residual risk and incident response testing.
How soon can an audit start in the Bay of Plenty?
Usually within a few weeks of agreeing scope, depending on our schedule and how quickly you can share documents. If you have a buyer or certification deadline, tell us at the outset and we will plan backwards from it. Steering clear of the busiest harvest weeks also helps, since operations staff are hard to interview then.
Will the audit report satisfy our overseas customer?
It is written to. We map findings to the clause or questionnaire your customer used, keep the executive summary short enough for a procurement team, and state scope and limitations clearly. What we cannot provide is a certificate: if the customer insists on ISO 27001 certification or a SOC 2 report, those come from an accredited certification body or a licensed CPA firm.
Do you review OT at coolstores and processing sites?
We review it from a governance and architecture angle: how operational technology is separated from corporate IT, who has remote access, how vendors connect and whether changes are controlled. That usually involves a site walk. Intrusive testing of live refrigeration or processing controls stays out of scope unless it is planned separately with the equipment owner, because the safety risk is real.
Next step
Send us the questionnaire, clause or board request that prompted the audit, and we will tell you the smallest scope that answers it. Get in touch or email info@secsolutionshub.com. We also audit in Auckland and across New Zealand.
