How to Benchmark NZ Cyber Security Frameworks: MGMT902 Assignment 2 Guide
You have a 3,000-word report on cyber security governance, a rubric that names NZ, Australian and international frameworks, and no clear idea which ones to put in a table and which to leave out. That is the usual starting point for MGMT902 Assignment 2, and the mistake that follows is almost always the same: a list of frameworks with no judgement about any of them. You can read the full task on the MGMT902 Assignment 2 question page.
Quick answer: to benchmark NZ cyber security frameworks in an MBA assignment, pick one real organisation, separate binding law (Privacy Act 2020) from voluntary benchmarks (NZISM, Essential Eight, ISO/IEC 27001), score the organisation against each, state the gaps, and rank fixes by risk reduction and cost. Evidence beats description in every mark band.
What the brief is really asking you to do
Read the task as three jobs, not one essay. The first 30 marks reward threat analysis and a risk management approach that uses NZ and AU instruments. The second 30 reward a benchmark with gaps, innovation ideas and a method for revising the ICT strategy. The last 40, the biggest block, reward ethics, Māori data sovereignty, cross-border data, stakeholder input and implementation.
Many students spend most of their words on the first block. That is backwards. The final block carries the most marks and is where generic answers collapse.
| Rubric block | Marks | What earns the top band | Where marks leak |
|---|---|---|---|
| Threats and NZ/AU regulatory risk | 30 | Named threats tied to one organisation, a layered risk framework, measurable improvements | Textbook threat lists with no company evidence |
| Security measures vs frameworks | 30 | A gap table, innovation with commercial value, a repeatable strategy-revision process | Describing frameworks instead of scoring against them |
| Ethics, social and cross-border | 40 | Māori data sovereignty, retention, offshore data, stakeholder evidence, a phased plan | One paragraph on “ethics” at the end |
If you want to see these three blocks answered end to end, our MGMT902 cyber security governance sample is a model answer for reference only, not for submission.
Which frameworks matter, and which are only benchmarks
A common pain point is whether the New Zealand Information Security Manual (NZISM) is mandatory. For a private company, generally it is not. The NZISM describes itself as the government’s manual on information assurance and systems security, aimed at agency security executives, vendors, contractors and consultants (Government Communications Security Bureau, n.d.). The Protective Security Requirements were directed by Cabinet at public service departments and certain agencies (National Cyber Security Centre [NCSC], n.d.). Say that plainly, then use both as benchmarks.
| Instrument | Country | Binding on a typical company? | How to use it |
|---|---|---|---|
| Privacy Act 2020, including IPP 3A from 1 May 2026 | NZ | Yes | Security, retention, offshore disclosure and breach notification |
| NZISM and PSR | NZ | No, for most private firms | Governance and control benchmark |
| ASD Essential Eight | AU | Not as law for most firms | Maturity scoring, levels 0 to 3 |
| Security of Critical Infrastructure Act 2018 | AU | Only for covered assets | Check scope before claiming it applies |
| Cyber Security Act 2024 | AU | Where thresholds are met | Ransomware payment reporting |
| ISO/IEC 27001:2022, UK CAF, NIS2, DORA | International | Not in NZ | Comparison points for accountability and resilience |
Two currency checks save embarrassment. IPP 3A applies to personal information collected indirectly from 1 May 2026 (Office of the Privacy Commissioner [OPC], 2025). And the UK Cyber Security and Resilience Bill was still before the House of Lords with no Royal Assent recorded at the time of writing (UK Parliament, 2026), so describe it as proposed, not in force.
Pick a company you can evidence
Your company choice decides how good the analysis can be. Choose an organisation with public material you can cite: regulator statements, annual reports, incident notifications. If you cannot find a source for a claim about internal controls, label it as an assumption. Examiners can tell the difference between an evidenced finding and a confident guess.
A useful pattern is to anchor the threat section in a documented incident. The NZ Privacy Commissioner’s office, for example, published figures for a major trans-Tasman lender breach and described the scope of its joint investigation with Australia’s regulator (OPC, 2023). Where an investigation is still open, evaluate governance design and avoid alleging wrongdoing. That caution reads as professional judgement.
Need a second pair of eyes on your company choice? Send us your brief and we will tell you whether the public evidence is deep enough.
A step-by-step approach for 3,000 words
- Spend 150 words on context. Name the organisation, its NZ/AU footprint and the data it holds. Skip the history.
- Build a threat table. Data breach, ransomware or extortion, supply chain compromise and social engineering, each with one piece of evidence. The NCSC (2025) report gives NZ-wide figures you can cite.
- Layer the risk framework. Law first, benchmarks second, control baseline third.
- Score against frameworks. Essential Eight maturity levels are the easiest scoring tool because they are explicit (Australian Signals Directorate, n.d.).
- Propose two or three innovations. Each needs value, delivery steps and a risk.
- Describe how the ICT strategy is revised. Five steps, repeated annually, tied to business and operational strategy.
- Write the ethics block early, not last. Draft it second so it gets real words.
- Close with a phased plan and named owners.
Māori data sovereignty is where NZ answers stand out
Overseas frameworks do not cover it, so a NZ marker looks for it. Te Mana Raraunga’s principles are rangatiratanga, whakapapa, whanaungatanga, kotahitanga, manaakitanga and kaitiakitanga. The first states that Māori have an inherent right to exercise control over Māori data (Te Mana Raraunga, 2018, as cited by Tertiary Education Commission, n.d.). Translate that into operations: know which datasets identify Māori, limit purposes, seek informed consent and consult Māori advisers. One concrete sentence like that outscores a page of general ethics.
The AI use appendix and referencing
The brief allows AI only as permitted and requires an AI Use Appendix and an Academic Integrity Declaration if you used it. Do not treat that as boilerplate. Record the tool, the purpose and what you changed. Our guide on what to do if Turnitin flags AI use explains the process, and the APA 7 referencing mistakes guide covers the citation errors that lose easy marks. For legislation, cite the Act with its jurisdiction, for example (Privacy Act 2020, NZ).
Mark-maximising checklist
- One named organisation, with at least four cited public sources about it
- A table separating binding law from voluntary benchmarks
- Every internal claim you cannot source marked as an assumption
- Essential Eight or ISO gaps scored, not described
- Māori data sovereignty tied to a named business process
- Stakeholder input shown changing a recommendation
- Phased plan with owners and measures
- Word count within the limit set in your brief, excluding references
Common mistakes we see
Calling NZISM “compulsory” for a private company. Citing NIS2 as if it binds a NZ firm. Pasting a framework’s headings instead of testing the organisation. Writing recommendations like “improve training” with no owner, date or measure. And leaving the 40-mark ethics block to the last 400 words.
If you are stuck on any of these, our management assignment help and MBA assignment help pages explain how we support postgraduate students with model answers and guidance. You remain responsible for your own submission and your institution’s rules. Our about page describes how we work.
About the reviewer
Daniel Thompson is an IT & Technology Assignment Specialist at Auckland University of Technology (AUT). His profile lists IT reports, systems analysis, database assignments and technology-focused projects.
Ready to turn your plan into a draft? Talk to our report writing team about your deadline, and bring the marking rubric with you.
Frequently asked questions
Is NZISM mandatory for private companies in New Zealand?
Generally no. The NZISM is written for government agencies and the vendors and consultants who serve them. A private company can adopt it voluntarily as a benchmark. In your assignment, state that it is not binding on your chosen company, then explain why it is still a credible yardstick.
Which Australian framework is easiest to score an organisation against?
The ASD Essential Eight, because each of its eight mitigation strategies is assessed at maturity levels zero to three. That gives you a clear table of current level, target level and gap, which suits a benchmarking task better than a narrative description.
Do I have to cover EU and UK laws like NIS2 and DORA?
The brief asks for international equivalents, so yes, briefly. NIS2 is Directive (EU) 2022/2555 (European Union, 2022a) and DORA is Regulation (EU) 2022/2554 (European Union, 2022b). Treat them as comparison points, not obligations, and say what they suggest about board accountability and third-party risk.
How should I handle Māori data sovereignty in a business assignment?
Name the principles from Te Mana Raraunga, then apply one or two to a real data process: identify Māori data, limit purpose, seek consent and consult Māori advisers. Keep it practical and specific to your organisation rather than a general statement of respect.
Can I use an organisation with an ongoing regulator investigation?
Yes, if you stay with the public record. Evaluate its governance design against the frameworks and avoid claiming it breached the law. Note that investigations are open and that no findings have been published, and use the regulator’s own wording for the scope.
What do I put in the AI Use Appendix?
List each tool, the date, the task it supported and how you checked and changed the output. Add the Academic Integrity Declaration your course requires. Keep it factual and complete, because an unexplained overlap with AI-generated text creates more risk than honest disclosure.
References
Australian Signals Directorate. (n.d.). Essential Eight maturity model. Australian Cyber Security Centre. https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model
European Union. (2022a). Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS2 Directive). Official Journal of the European Union. https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
European Union. (2022b). Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng
Government Communications Security Bureau. (n.d.). New Zealand Information Security Manual. https://nzism.gcsb.govt.nz/
National Cyber Security Centre. (n.d.). PSR annual self-assessment. https://www.ncsc.govt.nz/protect-your-organisation/psr-annual-self-assessment/
National Cyber Security Centre. (2025). Cyber threat report 2025: Reporting to the NCSC. https://www.ncsc.govt.nz/insights-and-research/cyber-threat-reports/cyber-threat-report-2025/incident-reporting-analysis/
Office of the Privacy Commissioner. (2023, May 10). New Zealand-Australia investigation into Latitude breach begins. https://www.privacy.org.nz/news/statements-media-releases/new-zealand-australia-investigation-into-latitude-breach-begins/
Office of the Privacy Commissioner. (2025, October). Guidance on IPP3A. https://www.privacy.org.nz/assets/DOCUMENTS/251104-IPP3A-guidance-A1128460.pdf
Privacy Act 2020 (NZ). https://legislation.govt.nz/act/public/2020/31/en/latest/
Tertiary Education Commission. (n.d.). The principles of Māori data sovereignty [Reproducing Te Mana Raraunga, 2018]. https://www.tec.govt.nz/teo/working-with-teos/analysing-student-data/key-components/community-perspectives/maori-data-sovereignty
UK Parliament. (2026). Cyber Security and Resilience (Network and Information Systems) Bill. https://bills.parliament.uk/bills/4035
