For information and reference only – not to be submitted as your own work. This extract shows how a Masters-level cyber security governance answer can be structured. Figures marked “illustrative” are teaching examples, not company data.
This model-answer extract responds to a typical MGMT902 Assignment 2 task: critically evaluate how an organisation operating in New Zealand or Australia governs cyber security and information risk, benchmarked against NZ and AU frameworks and international equivalents. It uses Latitude Financial Services, a trans-Tasman consumer finance group, because its 2023 data breach is documented by two national privacy regulators. If you want the approach rather than a worked example, read our guide to benchmarking NZ cyber security frameworks. The original brief is on the MGMT902 Assignment 2 question page.
Reviewed by: Daniel Thompson, IT & Technology Assignment Specialist, Auckland University of Technology (AUT). His profile lists IT reports, systems analysis, database assignments and technology-focused projects.
Scope, method and evidence base
The extract answers three rubric areas: threats and regulatory risk management (30 marks), evaluation of security measures against frameworks (30), and ethical, social and cross-border implications (40). It relies only on public record. Latitude’s internal controls are not public, so any statement about current internal practice is labelled illustrative and should be replaced with your own organisation’s evidence.
One caution first. The regulators’ investigation into Latitude was still open when the Office of the Australian Information Commissioner (OAIC, 2026) last updated its page, and no findings of non-compliance had been published there. The analysis below therefore evaluates governance design against frameworks. It does not allege failure.
Need a comparable analysis built around your own organisation and brief? Send your brief for a quote and we will scope it with you.
Part A – Threats, risk management and process improvement
A1. The threat picture
Cyber threats are a volume problem as well as a severity problem. New Zealand’s National Cyber Security Centre (NCSC) recorded 5,995 reports between 1 July 2024 and 30 June 2025, with direct financial loss of $26.9 million, and noted that not all losses are reported (NCSC, 2025). Of the 331 incidents of potential national significance, 137 were linked to criminal or financially motivated actors (NCSC, 2025).
| Threat | Relevance to a trans-Tasman lender | Evidence level |
|---|---|---|
| Data breach / credential compromise | Latitude reported that attackers used a compromised credential obtained via a third party (Latitude Financial Services, 2023). The data held included driver licence and passport details and income information. | Public record |
| Supply chain compromise | The third-party route to the credential makes supplier access the central design question for identity and access controls. | Public record; interpretation is the writer’s |
| Ransomware / extortion | Lenders hold data attractive for extortion. Since 30 May 2025 Australian entities above the turnover threshold must report ransom payments within 72 hours of the payment (Department of Home Affairs, n.d.). | Regulatory fact |
| Social engineering | Contact-centre and onboarding staff handle identity documents daily, which makes pretexting a plausible route. | Illustrative |
A2. A tailored risk management framework
No single NZ or AU instrument fits a private lender, so the defensible answer is a layered design. The New Zealand Information Security Manual (NZISM) is the government’s manual on information assurance and systems security and is written mainly for agencies, their vendors and contractors (Government Communications Security Bureau, n.d.). The Protective Security Requirements (PSR) were directed by Cabinet at public service departments and certain agencies (NCSC, n.d.). A private company is not bound by either, but both serve as credible benchmarks, and you should say so explicitly rather than pretend they are mandatory.
| Instrument | Binding on a private lender? | Role in the risk framework |
|---|---|---|
| Privacy Act 2020 (NZ) | Yes, for NZ personal information | IPP 5 (storage and security), IPP 9 (retention), IPP 12 (offshore disclosure); notifiable breach regime (Privacy Act 2020). |
| IPP 3A (from 1 May 2026) | Yes, for information collected from that date | Notification duties when information is collected indirectly, for example via a third party (Office of the Privacy Commissioner [OPC], 2025). |
| Australian Privacy Principles | Yes, for AU operations | Reasonable steps to protect information and to destroy or de-identify what is no longer needed, the very two questions the OAIC (2026) is examining. |
| ASD Essential Eight | Not as law for most private firms | Practical baseline: eight mitigation strategies assessed at maturity levels zero to three (Australian Signals Directorate [ASD], n.d.). |
| Security of Critical Infrastructure Act 2018 (Cth) | Only for responsible entities of covered assets | Part 2A risk management programs and Part 2B incident notification apply to defined assets (Security of Critical Infrastructure Act 2018). First step: check whether any of the organisation’s assets are captured. |
| Cyber Security Act 2024 (Cth) | Yes, where thresholds are met | Ransomware payment reporting, smart-device standards and a Cyber Incident Review Board (Cyber Security Act 2024). |
| NZISM / PSR | No (benchmark only) | Control catalogue and governance maturity reference. |
A3. Implications for ICT-enabled processes and improvement measures
The Privacy Act requires notification of the Privacy Commissioner and affected people “as soon as practicable” when a breach has caused or might cause serious harm, and the OPC says ideally within 72 hours of becoming aware (OPC, n.d.). That timeline should be built into the incident process, not discovered during one. In the Latitude case the company announced the incident on 16 March 2023 and told the OAIC and the OPC the same day (Latitude Financial Services, 2023).
Three process improvements follow from the threat table:
- Supplier and privileged access. Replace shared or long-lived credentials with phishing-resistant multi-factor authentication and time-bound access (maps to Essential Eight: multi-factor authentication, restrict administrative privileges).
- Data minimisation and retention. The OPC asked why past customers’ information was kept for long periods (OPC, 2023). Automate deletion or de-identification against a documented retention schedule (IPP 9).
- Tested notification playbook. One decision tree covering NZ serious-harm tests, AU obligations and ransom-payment reporting.
| Measure (illustrative targets) | Baseline | 12-month target |
|---|---|---|
| Third-party accounts with phishing-resistant MFA | Unknown – measure first | 100% of privileged supplier accounts |
| Records past retention period | Unknown – measure first | Under 2% of customer file |
| Time from detection to regulator decision | Unknown – measure first | Under 72 hours, rehearsed twice a year |
| Essential Eight maturity (self-assessed) | Unknown – measure first | Level 2 across all eight strategies |
Buy High-Quality Essays & Assignment Writing As
Per Particular University, High School Or College By NZ Writers
300+
PhD Writers
4.9/ 5 ratings
From Students
70 +
Subject Covered
10+
Years Of Experience
Part B – Security performance, innovation and ICT strategy alignment
B1. Benchmarking against NZ, AU and international frameworks
Benchmarking works best when each framework answers a different question. ISO/IEC 27001:2022 specifies requirements for an information security management system (International Organization for Standardization [ISO], 2022). The UK NCSC Cyber Assessment Framework (version 4.0) organises assessment under four objectives: managing security risk, protecting against attacks, detecting events and minimising impact (NCSC UK, 2024). UK Cyber Essentials, by contrast, is a minimum standard built on five technical controls (NCSC UK, n.d.).
| Framework | Type | What it tests | Gap question for the organisation |
|---|---|---|---|
| Essential Eight | AU technical baseline | Eight controls, maturity 0–3 | Which strategies sit below level 2, and why? |
| NZISM | NZ government manual | Governance and control catalogue | Is there a named accountable executive and a control owner list? |
| ISO/IEC 27001:2022 | International standard | Management-system discipline | Is certification a customer or insurer expectation? |
| UK CAF v4.0 | Outcome-based assessment | Objectives A to D | Can the organisation evidence detection and recovery, not only prevention? |
| EU NIS2 (Directive 2022/2555) | EU law | Risk-management and incident-reporting duties for in-scope entities (European Union, 2022a) | Management-body accountability as a design reference |
| EU DORA (Regulation 2022/2554) | EU financial-sector law | Digital operational resilience (European Union, 2022b) | ICT third-party risk as a reference for lenders |
| EU Cyber Resilience Act | EU product law | Reporting duties apply from 11 September 2026 (Jones Day, 2026) | Relevant only if the firm ships connected products |
| UK Cyber Security and Resilience Bill | Proposed UK law | Still before the House of Lords; no Royal Assent recorded (UK Parliament, 2026) | Treat as direction of travel, not current law |
The honest conclusion for a lender is that NIS2 and DORA are not binding, but they show where regulators are heading: named board accountability and tight third-party oversight. Both align with the supplier-access lesson in Part A.
B2. Innovation opportunities
Innovation should reduce risk and create commercial value together. Two examples, with illustrative value only:
- Verify, then discard identity documents. Use a digital identity check that returns a pass/fail result instead of storing scans. This shrinks the pool of attractive data. Commercial value: lower breach impact and lower storage cost. Risk: dependency on the verification provider.
- Continuous supplier assurance. Automated evidence collection against supplier contracts. Value: faster onboarding of partners. Risk: false confidence if evidence is self-attested.
B3. A systematic process for revising the ICT strategy
- Reaffirm business objectives and risk appetite with the board.
- Assess current capability against the benchmark table (Essential Eight levels, NIS2-style accountability, ISO 27001 gaps).
- Map each gap to a business process (onboarding, collections, customer service).
- Prioritise by risk reduction per dollar and by regulatory deadline.
- Fund, deliver, measure, then feed results back into step 1 each year.
This ties the ICT strategy to operational strategy (processes and suppliers) and organisational strategy (growth and trust) rather than treating security as a separate project. For help structuring this section for your own case, see our MBA assignment help page.
| Priority | Initiative | Why now |
|---|---|---|
| 1 | Supplier access and MFA | Directly addresses the publicly reported entry route |
| 2 | Retention and de-identification | Regulators have questioned long retention |
| 3 | Notification playbook and exercise | Cheap, fast, and tested by every regulator |
| 4 | ISO/IEC 27001 alignment | Medium-term assurance for partners and insurers |
Part C – Ethical and social implications, stakeholders and implementation
C1. Privacy, data sovereignty and cross-border transfer
The OPC said the Latitude breach exposed about 1.08 million New Zealand records, including roughly 1.037 million driver licence records and about 40,000 passport records, out of an estimated 14 million records across both countries (OPC, 2023). Scale matters ethically because identity documents cannot be reissued like a password. Customers were offered support in both countries, including IDCARE referral and reimbursement for replacement ID (Latitude Financial Services, 2023).
Cross-border handling raises a second issue. Where a trans-Tasman group stores NZ data in Australia or with offshore providers, IPP 12 governs disclosure outside New Zealand. Your answer should name where data sits and who can access it.
Māori data sovereignty is the NZ-specific dimension that overseas frameworks miss. Te Mana Raraunga’s principles are rangatiratanga, whakapapa, whanaungatanga, kotahitanga, manaakitanga and kaitiakitanga, and they assert that Māori have a right to exercise control over Māori data (Te Mana Raraunga, 2018, as cited by Tertiary Education Commission, n.d.). For a lender, practical steps include knowing which datasets identify Māori customers, applying consent and purpose limits, and consulting Māori advisers before using such data in analytics.
C2. Algorithmic bias and the digital divide
Credit models trained on historical data can reproduce disadvantage. Recommend documented model testing for disparate outcomes and a human review route. On the digital divide, customers without reliable internet or digital skills depend on phone support, and Latitude’s own response relied on phone support in both countries (Latitude Financial Services, 2023). Keep non-digital channels funded.
C3. Stakeholder engagement (illustrative log)
| Stakeholder | Illustrative input | How it shaped the recommendation |
|---|---|---|
| Security lead (IT specialist) | Supplier accounts are hard to inventory | Priority 1 starts with an access inventory |
| Collections manager (business) | Old files are needed for disputes | Retention schedule keeps dispute data, de-identifies the rest |
| Contact-centre manager | Verification slows calls | Digital check chosen to cut handling time |
| Māori adviser | Consent and purpose must be explicit | Data classification includes Māori data |
Replace this table with your own interviews. Markers reward evidence that you changed a recommendation because of what a stakeholder said.
C4. Implementation and governance
| Horizon | Actions | Owner |
|---|---|---|
| 0–3 months | Supplier access inventory, notification playbook, baseline Essential Eight self-assessment | Chief information security officer |
| 3–9 months | Phishing-resistant MFA for suppliers, retention schedule, tabletop exercise | CISO with business owners |
| 9–18 months | Identity-check redesign, ISO/IEC 27001 gap closure, Māori data governance protocol | Chief operating officer |
Governance should give the board a quarterly dashboard (maturity levels, retention backlog, supplier coverage) and a named executive accountable for each metric. Risks to the plan: budget competition, supplier resistance and change fatigue. Mitigate with a staged rollout and board-level sponsorship.
In quest for a professional assignment help?
Flexible rates compatible with everyone’s budget
Want this adapted to your own company, framework mix and word limit? Our report writing help team can prepare a model answer for your brief, and our warranty page sets out exactly what is covered. Browse more worked examples in our cyber security fundamentals sample, or see more Auckland Institute of Studies assignment briefs.
References
Australian Signals Directorate. (n.d.). Essential Eight maturity model. Australian Cyber Security Centre. https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model
Cyber Security Act 2024 (Cth). https://www.legislation.gov.au/C2024A00098/latest/text
Department of Home Affairs. (n.d.). Ransomware payment reporting: Frequently asked questions. https://www.homeaffairs.gov.au/cyber-security-subsite/files/ransomware-payment-reporting-faq.pdf
European Union. (2022a). Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS2 Directive). Official Journal of the European Union. https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
European Union. (2022b). Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector (DORA). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng
Government Communications Security Bureau. (n.d.). New Zealand Information Security Manual. https://nzism.gcsb.govt.nz/
International Organization for Standardization. (2022). Information security, cybersecurity and privacy protection – Information security management systems – Requirements (ISO/IEC 27001:2022). https://www.iso.org/standard/27001
Jones Day. (2026, July). EU Cyber Resilience Act: 24-hour reporting duties start September 11, 2026. https://www.jonesday.com/en/insights/2026/07/eu-cyber-resilience-act-24hour-reporting-duties-start-september-11-2026
Latitude Financial Services. (2023). Statement of notification. https://latitudefinancial.com.au/cyber-statement-of-notification
National Cyber Security Centre. (n.d.). PSR annual self-assessment. https://www.ncsc.govt.nz/protect-your-organisation/psr-annual-self-assessment/
National Cyber Security Centre. (2025). Cyber threat report 2025: Reporting to the NCSC. https://www.ncsc.govt.nz/insights-and-research/cyber-threat-reports/cyber-threat-report-2025/incident-reporting-analysis/
National Cyber Security Centre (UK). (n.d.). Cyber Essentials: Overview. https://www.ncsc.gov.uk/cyberessentials/overview
National Cyber Security Centre (UK). (2024). Cyber Assessment Framework (Version 4.0). https://www.ncsc.gov.uk/collection/cyber-assessment-framework
Office of the Australian Information Commissioner. (2026, September 25). OAIC’s action in relation to the 2023 Latitude data breach and information to update and assist individuals. https://www.oaic.gov.au/news/media-centre/oaics-action-in-relation-to-the-2023-latitude-data-breach-and-information-to-update-and-assist-individuals
Office of the Privacy Commissioner. (n.d.). Notify us of a privacy breach. https://www.privacy.org.nz/privacy-for-agencies/privacy-breaches/notify-us/
Office of the Privacy Commissioner. (2023, May 10). New Zealand-Australia investigation into Latitude breach begins. https://www.privacy.org.nz/news/statements-media-releases/new-zealand-australia-investigation-into-latitude-breach-begins/
Office of the Privacy Commissioner. (2025, October). Guidance on IPP3A. https://www.privacy.org.nz/assets/DOCUMENTS/251104-IPP3A-guidance-A1128460.pdf
Privacy Act 2020 (NZ). https://legislation.govt.nz/act/public/2020/31/en/latest/
Security of Critical Infrastructure Act 2018 (Cth). https://www.legislation.gov.au/C2018A00029/latest/text
Tertiary Education Commission. (n.d.). The principles of Māori data sovereignty [Reproducing Te Mana Raraunga, 2018]. https://www.tec.govt.nz/teo/working-with-teos/analysing-student-data/key-components/community-perspectives/maori-data-sovereignty
UK Parliament. (2026). Cyber Security and Resilience (Network and Information Systems) Bill. https://bills.parliament.uk/bills/4035
