Security Solution Consultants provides cyber security services in Wellington for government agencies and, just as often, for the vendors and consultancies that sell to them.
Wellington hosts roughly 43.6 percent of New Zealand’s public servants, and about 30 percent of jobs in the city are public sector. That shapes the compliance problem. For most Wellington organisations the obligation is not a direct statutory duty but contractual pass-through from the agency you serve.
Four instruments drive it. NZISM version 3.9, published April 2025, is explicitly written for vendors, contractors and consultants serving agencies, not only for agencies themselves. The Protective Security Requirements set 20 mandatory requirements across governance, personnel, information and physical security, with agency reporting due 30 April and PS-CMM level 2 as the minimum baseline. The Minimum Cyber Security Standards 2025, version 3, published 30 October 2025, apply to GCISO-mandated agencies across ten standards. And the Marketplace Information Security Tiering Standard version 1.0, issued 17 February 2026, is the sharpest lever of all.
Our Cyber Security Services in Wellington
- NZISM v3.9 control evidence. Mapping and evidence packs that survive an agency’s assurance review rather than triggering another round of questions.
- Marketplace tiering readiness. CS-CMM2 independent audit preparation for Tier 2, and the CS-CMM3 certification path before the two-agency threshold triggers it.
- PSR support. Governance, personnel and information security requirements, including the PERSEC obligations that reach suppliers as vetting and assurance.
- MCSS alignment for GCISO-mandated agencies across the ten standards, scoped to business critical and externally facing systems.
- ISO 27001 ISMS certification. Widely accepted as supporting evidence across NZISM and Marketplace assurance, and it shortens the evidencing effort considerably.
- Business continuity management. Continuity and resilience planning aligned to agency expectations.
The Marketplace Tiering Standard Is Where Vendors Stall
Most Wellington vendors handle their first agency contract on goodwill and a completed questionnaire. The second one is where it breaks. Under the Marketplace Information Security Tiering Standard, Tier 2 requires independent audit at CS-CMM2, and once two agencies consume your service, full certification at CS-CMM3 is required.
Vendors typically discover this at the exact moment it blocks a deal they have already forecast. Planning the certification path in advance is far cheaper than scrambling through it, which is why our cyber security services in Wellington usually start with a tiering assessment rather than a control audit.
GRCLens: One Evidence Base, Every Agency
GRCLens maps NZISM, PSR, MCSS and ISO 27001 to a single shared control model. Evidence captured once serves every agency assurance request, which matters when you are selling to several departments with slightly different questionnaires.
Why Wellington Organisations Choose Security Solution Consultants
- We treat this as a supply chain problem, which is what it actually is for most Wellington firms.
- Familiar with the Marketplace tiering path, including the CS-CMM thresholds that catch vendors out.
- Fixed-scope engagements, so cyber security services in Wellington come with a defined deliverable and price.
- Local delivery with on-site workshops in Wellington for evidence walkthroughs and executive sessions.
Frequently Asked Questions
Does NZISM apply to us if we are a private company?
Not as a legal obligation, but NZISM v3.9 is explicitly written to cover vendors, contractors and consultants serving agencies. If you hold or process agency information, expect to evidence NZISM controls contractually.
Is MCSS actually in force?
Yes. The Minimum Cyber Security Standards 2025 version 3 were published on 30 October 2025 by the NCSC for GCISO-mandated agencies. The first reporting period ran from 1 November 2025 to 30 April 2026, with formal alignment to the PSR reporting period from November 2026.
What is the Marketplace tiering standard and when does it bite?
Version 1.0 was issued on 17 February 2026. Tier 2 requires independent audit at CS-CMM2. Once two agencies consume your service, full certification at CS-CMM3 is required. Most vendors meet it at the point it blocks their second agency deal.
Should we still report incidents to CERT NZ?
Report to the NCSC. CERT NZ merged into the NCSC and the brand has been phased out. There is a single reporting channel at ncsc.govt.nz/report and on 0800 114 115.
Do we need a security clearance to work with agencies?
It depends on the information involved. PSR personnel security requirements reach suppliers through vetting obligations in contracts. We help you work out what is genuinely required for your scope rather than over-committing during a tender.
Get Started
If you need cyber security services in Wellington from a team that understands the agency supply chain, request a Marketplace tiering assessment, an NZISM gap review, or a GRCLens demo. Contact us to talk it through. We also work in Auckland, across New Zealand, and in Melbourne.
