December isn’t just the silly season, Central government agencies are also into the annual Protective Security Requirements self-assessment season.
And just to make things a bit more chaotic, the PSR self-assessment has been updated this year, with three main changes.
Firstly, the reporting period is a calendar year, so agencies will report against their PSR maturity up to 31 December 2025. Not a big deal, but worth remembering in case agencies were planning on reporting on a project that goes live March 2026.
Secondly, the PSR has a new self-assessment tool in which agencies need to put a Yes / Partial / No / N/A / Compensating Control response to all of the more detailed policy statements across each of the 20 mandatory requirements. There are roughly 750 of these MUST/SHOULD/COULD requirements across the maturity model. We recommend that agencies prioritise answering the maturity 2 (MUSTs) and 3 (SHOULD) questions and only spend time addressing COULDs where you know you have an area of strength.
Finally, agencies will be also reporting against the NCSC’s recently released Minimum Cyber Security Standards (the NCSC Standards). The NCSC Standards set out ten different requirements across the NCSC cyber security framework. These are new and ask agencies to report against cyber security aspects like security monitoring, privileged access management and asset registry.
Our advice? If you haven’t started your PSR reporting yet, get started this side of Christmas (your future self will thank you).
We’re also fielding questions from non-government organisations about the NCSC and PSR Standards. We can conduct a standalone assessment if you or your board wants to understand how you measure up against the new Standards without tackling the full PSR.
If you want to discuss the updates to the PSR, or want some help with PSR or NCSC Standards, please just reach out to either:
Ben (ben.creet@bastionsecurity.co.nz),
or Harley (harley.dixon@bastionsecurity.co.nz), we’re here to help.
Kia pai to rā,
Ben & Harley, your local PSR nerds