MGMT902 Assignment 2: Information Security, Risk Management and ICT Strategy

This MGMT902 report asks postgraduate students to critically evaluate how one organisation operating in New Zealand or Australia governs its cyber security and information risk. Students analyse the threat landscape and regulatory duties, benchmark existing controls against New Zealand, Australian and international frameworks, design an ICT strategy that fits the business strategy, and assess the ethical, social and cross-border effects of the organisation’s technology use.

Assessment Overview

Critically evaluate how an organisation operating in New Zealand or Australia governs its cyber security and information risk, and benchmark that approach against the frameworks and standards applied in New Zealand and Australia. Analyse the organisation’s threat landscape and regulatory obligations, evaluate the effectiveness of its existing security measures against recognised frameworks, and assess the broader ethical, social and cross-border implications of its ICT initiatives. You may select an organisation you have previously studied, provided it operates in New Zealand or Australia and sufficient publicly available information exists.

Report Question

How effectively can a comprehensive approach to information security and risk management apply New Zealand and Australian cyber security frameworks and standards to govern the technical, operational, ethical and social challenges of ICT adoption at a company of your choice, and what can be learned from relevant international equivalents?

a. Cyber Security Threats, Risk Management and Process Improvement (30 Marks)

• Critically analyse the prevalent cyber security threats facing the company, including data breaches, ransomware and extortion, supply chain compromise and social engineering.
• Develop a tailored risk management framework by critically applying relevant New Zealand and Australian cyber security frameworks, standards and regulatory requirements.
• Evaluate the implications of the identified risks for key ICT-enabled business processes and determine major opportunities to improve process performance, resilience and security.
• Formulate and justify improvement initiatives and establish measures for evaluating their effectiveness.

Relevant instruments may include the New Zealand Information Security Manual (NZISM), the Protective Security Requirements (PSR), the Privacy Act 2020 including the notifiable privacy breach scheme and IPP 3A, the ACSC Essential Eight and Information Security Manual, the Security of Critical Infrastructure Act 2018 and the Cyber Security Act 2024.

b. Security Performance, Innovation and ICT Strategy Alignment (30 Marks)

• Critically evaluate the effectiveness of existing information security measures by benchmarking current practices against New Zealand, Australian and international frameworks and standards.
• Identify material gaps in existing security and ICT-enabled processes and formulate evidence-based enhancements.
• Assess opportunities for technological and process innovation, critically evaluating their organisational and commercial value, implementation requirements, risks and contribution to sustained performance.
• Formulate a systematic process for developing or revising the organisation’s ICT strategy, and critically compare it with the operational strategy, organisational strategy and wider business objectives, justifying how information systems, cyber security and innovation initiatives should be prioritised and aligned.

The comparative analysis may draw on the UK NCSC Cyber Assessment Framework (CAF) and Cyber Essentials, the NIS Regulations 2018 and the Cyber Security and Resilience Bill, the EU NIS2 Directive, the GDPR, the Digital Operational Resilience Act (DORA), the Cyber Resilience Act and ISO/IEC 27001:2022.

c. Ethical and Social Implications, Stakeholder Communication and Strategic Implementation (40 Marks)

• Critically evaluate the ethical and social implications of widespread ICT adoption within the company, including data privacy, data sovereignty, cross-border data transfer, algorithmic bias and the digital divide.
• Analyse the broader implications of ICT adoption for societal domains such as employment, education and healthcare that are materially affected by the organisation’s activities.
• Develop and justify strategies that promote ethical ICT practices, mitigate social inequalities and strengthen responsible ICT governance.
• Engage with internal IT specialists and business managers on the identified risks, ethical issues, process improvements and strategic initiatives; synthesise their perspectives and critically evaluate how stakeholder input shaped the final analysis, priorities and recommendations.
• Formulate practical, evidence-based recommendations for implementing, governing and sustaining the proposed ICT, information security and process improvements, showing how they support operational priorities, organisational strategy and longer-term objectives.