Security Solution Consultants (SSC) provides the cyber security services Dunedin and Otago organisations need when a research partner, a health customer, an export buyer or a regulator wants proof rather than reassurance. We are a cyber security and GRC consultancy based in Tarneit, in Melbourne’s west, working remote-first across New Zealand and travelling to Otago when a workshop, a site visit or a board briefing works better face to face. In Dunedin our work covers obligations mapping, certification readiness, health sector security, audits and incident readiness.

Dunedin’s economy has an unusual centre of gravity. The University of Otago employs 4,013 full-time equivalent staff, teaches 18,690 full-time equivalent students, supports 6,259 full-time equivalent jobs and contributes about $1.31 billion to the city, roughly 15% of its gross regional product. Around it sit health services, research groups, a cluster of 20 to 30 game studios, and the head office of Silver Fern Farms. Across the wider region, Otago exported $3.14 billion of goods in 2024, led by dairy ($933 million), meat ($787 million) and fruit ($517 million). That mix puts sensitive personal, health and research data in the city, and food safety and export assurance across the region.

Which rules apply in Otago

Which cyber security obligations apply to Otago organisations, by type of organisation
Start with what kind of organisation you are: universities, health suppliers, processors and councils each carry a different mix of obligations.

Obligations in Otago follow the kind of organisation you are. Larger organisations usually sit in several of these groups at once.

Anyone holding personal information. The Privacy Act 2020 covers businesses, charities, clubs, councils and tertiary institutions alike. From 1 May 2026 its principles include IPP3A, which adds a duty to take reasonable steps to tell people when you have gathered information about them from a third party. For a research team receiving participant data from a partner institution, or a game studio receiving player data from a publisher, that is a new notification step to design. Notifiable breaches go to the Privacy Commissioner, ideally within 72 hours.

Health providers and their suppliers. Health organisations work to the HISO 10029:2022 Health Information Security Framework, with 2023 segment guidance for hospitals, micro to small providers and medium to large providers. Since 6 May 2025, HISO 10029.4:2025 has set expectations for suppliers, covering SaaS vendors, ISPs, outsourced providers and their subcontractors. A Dunedin software house or IT provider with health customers should expect to be assessed against it.

Councils. Dunedin City Council and the Otago Regional Council sit outside the PSR’s mandatory list. Their more likely benchmark is the Auditor-General, whose April 2025 report Mind the gap: Governing cyber security risks concluded that most organisations reviewed were living with more cyber risk than they had said they would accept, and were not rehearsing incident response often enough.

Suppliers to government agencies. Research and software firms with central government contracts meet the PSR and NZISM v3.9 through GOV 5 clauses in their agreements. Under the Government Procurement Rules (5th edition, 1 December 2025), the agency must also risk-assess any public cloud service you provide.

Food processors and exporters. Meat and dairy processors and their export chain operate under MPI Risk Management Programmes. Those programmes depend on records, and the systems that hold them deserve the same protection as any other business-critical data.

Financial services. Entities regulated by the Reserve Bank, such as banks and insurers, must report material cyber incidents within 72 hours, and FMA-licensed firms carry the same window under their standard licence condition.

Certifications Dunedin businesses ask us about

  • SOC 2. Dunedin builds data businesses with global customer bases: Oritain, the origin verification company, serves more than 1,800 customers. Software, data and game technology firms selling into North America are commonly asked for SOC 2. A licensed CPA firm issues the report; we prepare the controls and the evidence.
  • ISO/IEC 27001. Commonly requested by health, education and government customers of Dunedin IT and software firms, and a strong foundation for HISO 10029.4 supplier evidence. We build the management system and run the internal audit; an accredited certification body certifies. For the New Zealand specifics, see ISO 27001 certification in New Zealand.
  • ISO/IEC 42001. Research groups, spinouts and studios using machine learning are starting to be asked how their AI is governed. ISO 42001 gives that structure and fits with MBIE’s Responsible AI guidance of 8 July 2025 and the National AI Strategy.
  • ISO 9001. Engineering, manufacturing and facilities firms supplying hospital, university and council estates commonly find quality certification among the tender criteria.
  • ISO 22000 and FSSC 22000. With Silver Fern Farms headquartered in the city, and meat, dairy and fruit making up most of Otago’s exports, food safety certification is a common buyer requirement. Processors can build ISO 22000 or FSSC 22000 on the hazard analysis and verification already in their MPI Risk Management Programme.
  • Critical infrastructure resilience. For lines companies, water services and telecommunications operators moving towards essential infrastructure provider status, we offer energy sector security assessments, business continuity management and OT and critical infrastructure training.

Critical infrastructure in Otago

Critical infrastructure regulation in New Zealand is still being designed. DPMC’s discussion document on the cyber resilience of critical infrastructure opened for submissions on 27 February 2026 and closed on 19 April, and there is no bill in Parliament yet. Emergency management law has moved faster: the Emergency Management Bill (No 2) passed its third reading on 28 August 2026, and under it lifeline utilities become essential infrastructure providers.

In Otago that matters for the electricity, water, telecommunications and transport operators that keep the city and the region running, and for the large institutions that lean on them. A hospital, a university campus and a meat processing plant all assume that power, network links and water will be there. Rather than waiting for final rules, operators can use the time to answer three questions. Which systems would we need in the first 48 hours after an outage or attack? Which suppliers could stop them? Could we prove both to a regulator? Our continuity and energy security work is built around those questions.

Our services in Dunedin

Universities, research and health data

For a city of its size, Dunedin holds a large concentration of sensitive data: student and staff records, research datasets that may include health information, clinical records and the commercial data of young companies. Much of it sits in systems that many people can log into.

That last point is the lesson of the University of Otago’s 2022 incident. Between 23 August and 5 October 2022, a student database was exposed to people holding university logins. Exposure to existing account holders is a risk that rarely trips an alarm, because every access looks legitimate, and any organisation with thousands of accounts, shared drives and older databases carries it.

For Dunedin organisations handling research or health data, the practical controls follow from that:

  • Know where sensitive datasets live, who owns each one and how it is classified.
  • Review access to shared drives, databases and research platforms on a schedule, and remove inherited or group-wide access that nobody consciously granted.
  • Log access to the most sensitive records and have someone look at the logs, so unusual browsing is noticed.
  • Apply HISO 10029.4:2025 to the suppliers who host or process health data, including research tools and survey platforms.
  • Build IPP3A notices into data sharing agreements when participant data comes from partner organisations.

Patient platforms are also under national scrutiny, with phase one of the Manage My Health inquiry dated 25 May 2026. Health software suppliers in the city should plan for more questions from customers, not fewer.

New Zealand rules that sit over everything

Five national instruments shape our Otago work. The Privacy Amendment Act 2025, which received assent on 23 September 2025, inserted IPP3A into the Privacy Act 2020 with effect from 1 May 2026. NZISM v3.9 (April 2025) and the Protective Security Requirements govern mandated agencies and reach their suppliers, and incidents are reported to the NCSC, which took over the role of CERT NZ in 2023 (see ncsc.govt.nz/report). HISO 10029.4:2025 governs health suppliers. The Reserve Bank’s 72 hour cyber incident reporting has applied since 8 April 2024, and the final tranche of Deposit Takers Act standards, consulted on from June to September 2026, is due to be issued by 31 May 2027 and take effect on 1 December 2028; the FMA applies a matching 72 hour rule to licensed firms. Finally, the Biometric Processing Privacy Code 2025 covers facial recognition and fingerprint systems, with processing that predated it required to comply by 3 August 2026.

GRCLens for Otago organisations

A Dunedin software firm might need ISO 27001, HISO 10029.4 supplier evidence and a SOC 2 readiness pack for the same group of customers. GRCLens, the GRC platform we build, links each requirement to a shared control, so one piece of evidence answers all three and every report draws on the same source.

Looking for an independent audit?

If you need a point-in-time view rather than ongoing advice, our page on cyber security audit services in Dunedin and Otago explains scope, standards, timing and what the report contains.

Penetration testing and security testing in Dunedin

In 2022 a software fault at the University of Otago left a student database open to anyone with a university login for about six weeks. Broken access control of that kind tops the OWASP Top 10:2025, and it is the first thing authenticated web application testing looks for: can one user see what another should not?

Penetration testing in Dunedin covers student, research and patient-facing applications, the APIs behind them and the internal networks of large institutions where access has accumulated over years. Research teams sharing data with partners benefit from threat modelling of those data flows, and health software suppliers working to HISO 10029.4:2025 can add secure code review before release. Meat and dairy processors in Otago can include a passive OT assessment, and Dunedin’s game and technology studios running online services can test their backends and APIs. See our penetration testing services, or a cyber security audit in Dunedin.

Frequently asked questions

Which cyber security rules apply to a Dunedin health software supplier?

Start with HISO 10029.4:2025, the supplier part of the Health Information Security Framework, published on 6 May 2025 for SaaS providers, ISPs, outsourced providers and subcontractors. The Privacy Act 2020 applies to the patient information you handle, and many health customers also ask for ISO 27001. We map the three together so one set of controls and evidence serves them all.

What can other organisations learn from the University of Otago’s 2022 database exposure?

That internal access settings matter as much as perimeter defences. The student database was exposed to university logins from 23 August to 5 October 2022. Any organisation with thousands of accounts, shared drives and legacy databases faces a similar risk. Regular access reviews, named data owners and logging of sensitive records are the controls that catch it early.

Does IPP3A affect university and research projects?

It can. Since 1 May 2026, if a project collects personal information about participants from another organisation, such as a partner institution or a health provider, IPP3A requires reasonable steps to make sure those people know, unless an exception applies. Research teams should check data sharing agreements and participant information so the notification question is settled before data arrives.

We process meat or dairy for export. How does cyber security relate to our MPI programme?

Your Risk Management Programme depends on records: monitoring data, verification results, traceability and export documentation. If ransomware locks those systems, you may struggle to demonstrate compliance or release product. Treating RMP systems as critical in backup, access control and continuity planning protects your food safety evidence. ISO 22000 or FSSC 22000 can then build on the same foundations.

Is there a critical infrastructure cyber law Otago operators must meet today?

Not a dedicated one. DPMC consulted on critical infrastructure from 27 February to 19 April 2026, and no bill has followed yet. The Emergency Management Bill (No 2), which passed its third reading on 28 August 2026, turns lifeline utilities into essential infrastructure providers. Operators are better placed strengthening continuity and OT security now than waiting for final rules.

Do Dunedin game studios need ISO 27001 or SOC 2?

Neither is required by law, but publishers, platform partners and enterprise clients commonly ask for evidence of security. ISO 27001 suits studios wanting an internationally recognised certificate; SOC 2 suits those selling software or services to North American businesses. A short readiness review tells you which one your customers will accept and how far you are from it.

Will you come to Dunedin in person?

Yes, where it helps. Most consulting runs remotely from Tarneit, which keeps costs down for Otago clients. We plan visits for workshops with leadership or research teams, physical security and plant walkthroughs, OT reviews at processing sites, and presenting findings to a board or committee, grouping activities so each trip is worth making.

Next step

Let us know what started the conversation, whether a research partner’s data clause, a health customer’s supplier questionnaire, a certification target or a board question, and we will propose a scope that fits. Contact us or email info@secsolutionshub.com. We also support organisations in Wellington, Auckland and throughout New Zealand, including small businesses.