National Cyber Security Centre

What National Cyber Security Centre does

National Cyber Security Centre (NCSC) is New Zealand's national cyber security authority, operating as a directorate within the Government Communications Security Bureau (GCSB). It was established in 2011 with statutory regulatory authority added through the Telecommunications (Interception Capability and Security) Act 2013 (TICSA). NCSC serves the New Zealand government, critical infrastructure operators, private sector businesses, and the general public by providing cyber threat intelligence, defensive guidance, and incident response coordination. The organisation participates in the Five Eyes intelligence-sharing alliance alongside peer agencies in Australia (ASD/ACSC), the United Kingdom (NCSC-UK), the United States (CISA/NSA), and Canada (CCCS).

NCSC's core products include the Minimum Cyber Security Standards (MCSS) launched in October 2025, the NCSC Cyber Security Framework (currently in beta), the publicly available threat advisory stream, breach notification services, and the Cyber Smart Week public awareness campaign. The organisation has released a focused suite of AI-specific guidance covering frontier AI risks to cyber defence, the careful adoption of agentic AI services, and joint Five Eyes AI preparedness. Service delivery integrates third-party tools such as the Have I Been Pwned API for credential compromise checking and includes vulnerability disclosure handling alongside the.nz CERT function. The NCSC operates with a lean headcount of approximately 24 personnel.

The business model is government-funded through Crown appropriations via the GCSB; services are provided free of charge and the agency does not generate commercial revenue. Under TICSA, NCSC exercises statutory regulatory authority over telecommunications operators and government agencies, creating a compulsory rather than commercial customer relationship. The agency is positioned as the authoritative national source for cyber security guidance and regulatory oversight, with operational reach into both regulated entities and the broader public via awareness campaigns and open-access advisories.

Name

National Cyber Security Centre

Legal name

National Cyber Security Centre

Website

https://ncsc.govt.nz

Company type

Private

Operating status

Operating

Headcount range

11–50 employees

Short description

New Zealand's national cyber security authority, operating within GCSB, delivering free cyber security guidance, threat intelligence, and statutory regulatory oversight under TICSA to government agencies, critical infrastructure, businesses, and the public.

Ownership category

akta.pro rank

Product category

National Cyber Security Services

NAICS

National Security (928110), Public Administration (92), International Affairs (92812)

akta.pro primary industry

Cyber Defense & Information Security (National Security) (BPAIAHAE)

akta.pro secondary industries

Critical Infrastructure Protection (CIP) & NERC-CIP Compliance (HDADAJAC), Privacy, Data Protection & Cyber Governance (GRC) (BPAHAFAF)

Keywords

• Cyber security services
• Threat intelligence
• Regulatory oversight
• Network security
• Incident response

Headquarters

HQ city

Wellington

HQ country

New Zealand

HQ region

Oceania

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. Government Funding: The NCSC is part of the Government Communications Security Bureau (GCSB) and operates as a New Zealand government agency. As a public sector organisation, the NCSC is funded through government appropriations and does not charge for its core services including cyber security guidance, incident response, vulnerability coordination, and regulatory oversight under TICSA.

Go-to-market motion1 record

Distribution channels5 records

Marketing channels9 records

Core offering

The National Cyber Security Centre (NCSC) is a New Zealand government agency that provides cyber security services, threat detection and response, regulatory oversight under the Telecommunications (Interception Capability and Security) Act 2013 (TICSA), and publishes cyber security guidance and standards for government agencies, critical infrastructure operators, and the public.

Product overview

The National Cyber Security Centre (NCSC) is New Zealand's government cyber security agency operating within the Government Communications Security Bureau (GCSB). NCSC provides a portfolio of cyber security services including the Cyber Security Framework (a five-function framework for organizing cyber security efforts), the Minimum Cyber Security Standards (10 baseline standards for government agencies), TICSA network security regulatory services, coordinated vulnerability disclosure support, and consumer resources like Own Your Online. Key tools include the 'How Exposed Am I' breach checker, incident reporting tools, cyber threat reports, and the Cyber Smart Week annual awareness campaign. The organization also publishes the New Zealand Information Security Manual (NZISM) and issues time-sensitive alerts on vulnerabilities and threats.

Differentiator

Problem solved

Functional benefit

Brands

• Own Your Online: A public cyber security awareness campaign and website (ownyouronline.govt.nz) aimed at helping New Zealanders protect themselves online.
• How Exposed Am I

Products and services

• Critical Controls

Named customers1 record

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration1 record

Feature4 records

Partnerships

Nine partnerships are on record, tiered core.

• New Zealand PolicecoreStrategic or Co-development PartnerNew Zealand Police is a partner agency of the NCSC. Police is responsible for the interception capability requirements of TICSA and maintains the Register of Network Operators on behalf of surveillance agencies. The NCSC may refer matters to Police and share incident information with consent.
• Department of Internal AffairscoreStrategic or Co-development PartnerDepartment of Internal Affairs is a partner agency of the NCSC. The NCSC may collect information about incidents that are more appropriately handled by DIA and refer matters accordingly, with consent from the reporting party.
• Department of Prime Minister and CabinetcoreStrategic or Co-development PartnerDepartment of Prime Minister and Cabinet is a partner agency of the NCSC for handling cyber incidents that require cross-government coordination.
• NetsafecoreStrategic or Co-development PartnerNetsafe is listed as a partner agency of the NCSC for cyber security matters, providing an additional pathway for New Zealanders to report and receive support for online issues.
• Ministry of Business, Innovation and Employment (MBIE)coreStrategic or Co-development PartnerMBIE is the administering agency of TICSA on regulatory stewardship and ensuring legislative settings remain fit for purpose. The NCSC works with MBIE on TICSA regulatory functions.
• Five Eyes Partners (US NSA, UK NCSC, Canadian CSE, Australian ASD)coreStrategic or Co-development PartnerThe NCSC participates in the Five Eyes intelligence alliance alongside counterparts from the US, UK, Canada, and Australia. In June 2026, leaders of Five Eyes cyber security agencies issued a joint call to action on AI preparedness to address evolving cyber risk landscape driven by Frontier AI.
• New Zealand Security Intelligence Service (NZSIS)coreStrategic or Co-development PartnerNZSIS is part of the New Zealand Intelligence Community (NZIC) alongside the NCSC. NZSIS conducts vetting assessments for security clearances required under TICSA for network operators.
• Government Communications Security Bureau (GCSB)coreStrategic or Co-development PartnerThe NCSC is organisationally located within the GCSB. The Director-General of GCSB holds the statutory regulatory role for network security under TICSA, exercised through the NCSC's Regulatory Unit.
• Protective Security Requirements (PSR)coreStrategic or Co-development PartnerThe NCSC works with the Protective Security Requirements framework which outlines the Government's expectations for managing personnel security, physical security, and information security across government agencies.

Scale indicators2 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• Bundesamt für Sicherheit in der Informationstechnik (BSI): Germany's federal cyber security authority, responsible for government IT security, standards, and critical infrastructure protection. Directly comparable to NCSC in its standards-setting, regulatory, and CERT roles.
• JPCERT Coordination Center: Japan's national CERT handling incident coordination, vulnerability disclosure, and threat intelligence for Japanese organizations. Comparable to NCSC on the CERT, vulnerability coordination, and technical guidance axes.
• Indian Computer Emergency Response Team (CERT-In): India's national CERT under the Ministry of Electronics and Information Technology, providing incident response, threat advisories, and cyber security guidance. Comparable in mission to NCSC, though operating at much larger scale.
• Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI): France's national cyber security agency, providing CERT, regulatory oversight of critical infrastructure operators, and cyber standards. Matches NCSC's combination of regulatory authority and national standards leadership.
• UK National Cyber Security Centre (NCSC): The UK's national cyber security agency, also part of its intelligence community (GCHQ). Shares the same CERT, standards-setting, incident response, and government agency uplift mandate as NZ NCSC, and is its named Five Eyes partner.
• ENISA (European Union Agency for Cybersecurity): EU agency providing cyber security expertise, standards, and CERT coordination across member states. Closely comparable mandate to NCSC at a supranational level, focused on frameworks, capacity building, and threat intelligence sharing.
• Australian Cyber Security Centre (ACSC): Australia's national cyber security hub within the Australian Signals Directorate, providing CERT, threat intelligence, standards, and government uplift. Closest regional peer and Five Eyes partner of NZ NCSC.
• Canadian Centre for Cyber Security (Cyber Centre / CSE): Canada's national CERT and cyber authority under the Communications Security Establishment. Mirrors NCSC's role as the unified hub for government cyber guidance, incident response, and threat intelligence, and is a Five Eyes partner.

Broad incumbents

• Cybersecurity and Infrastructure Security Agency (CISA): US federal agency responsible for critical infrastructure cyber security, standards, and government civilian cyber defense. Operates at much larger scale than NCSC but shares the system-leader mandate for national cyber resilience and is a Five Eyes partner.

Regional players

• Cyber Security Agency of Singapore (CSA): Singapore's national cyber security authority overseeing cyber strategy, standards, and CERT operations for the country. Comparable mandate to NCSC but operates in a different geography with a stronger focus on national cyber strategy.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks5 records

Key highlights5 records

Customer concentration

• LinkedInlinkedin.com/company/ncsc-nz

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about National Cyber Security Centre