ShareAndGoShareAndGo

Regulation

The Reserve Bank's cyber resilience guidance, and what it means for suppliers.

Banks, insurers and other entities regulated by the Reserve Bank of New Zealand, Te Pūtea Matua, rely on outside services for much of their technology, from core platforms to the tools staff use to share documents with advisers and counterparties. Each of those services is part of the entity's cyber risk.

This article summarises what the Reserve Bank has published on cyber resilience, how its guidance treats third parties, and the questions a regulated entity may reasonably ask of a document-sharing service. It is a summary, not advice; the Reserve Bank's own publications are the authoritative source.

Who the guidance covers

The Reserve Bank says it published cyber risk management guidance in April 2021 for all the entities it regulates: registered banks, non-bank deposit takers, licensed insurers and designated financial market infrastructures.

The Reserve Bank describes the guidance as a governance framework for managing cyber risk, with high-level, principle-based recommendations that entities can tailor to their own needs and technologies. It says the guidance draws from leading international and national cybersecurity standards and is intended to illustrate current best practice while encouraging continual improvement.

The four parts

According to the Reserve Bank, the guidance is in four parts:

  1. Governance, which outlines roles and responsibilities for the board and senior management, and the need for an effective strategy for cyber resilience.
  2. Capability building, which sets out five areas of focus for building cyber resilience.
  3. Information sharing, which encourages entities to use reliable channels and supports a trusted environment for sharing information.
  4. Third-party management, which focuses on cyber risk related to outsourcing.

The fourth part is the one that reaches suppliers. When a regulated entity uses an outside service, the cyber risk of that service becomes part of the entity's own risk to manage.

Incident reporting

Alongside the guidance, the Reserve Bank collects cyber resilience information. It says registered banks, non-bank deposit takers and insurers are required to report material cyber incidents to it as soon as practicable, and within 72 hours. It also describes periodic reporting of all cyber incidents, which its page marks as currently paused, and self-assessment surveys against the guidance.

For suppliers, the practical consequence is simple. If an incident at a supplier could become a material incident for the regulated entity, the entity needs to hear about it quickly, and will want to know the supplier can tell it promptly and clearly what happened.

Questions a regulated entity may ask of a document-sharing service

Document-sharing tools are often adopted by a single team, such as finance, the in-house lawyers or corporate development, for a specific deal or review. They still hold some of the entity's most sensitive information. Reasonable questions, framed by the third-party management theme, include:

  • How are people outside the organisation verified before they open documents?
  • Can access be limited to specific folders, and ended on a date or at any time?
  • Can downloads, printing and copying be controlled, and does view-only keep the original file away from the viewer?
  • What record is kept of views, downloads and changes, and can it be exported?
  • How are uploads checked for malware?
  • How do staff sign in, and is two-step verification available?
  • Where are documents held, which other services are involved, and how would the supplier tell you about an incident?

The answers matter more than any label. An entity applying principle-based guidance needs to understand what a service actually does, so it can judge the risk for itself.

How ShareAndGo answers the practical questions

  • Recipients confirm their email address with a six-digit code before they can open a room.
  • Groups see only the folders you allow; invitations can carry an end date, be extended in one click and be revoked at any time.
  • Download, print and copy are set per room and per group. View-only recipients see documents rendered on our side with a personal watermark, and the original file is never sent to their browser.
  • The audit log records every view, upload, download, invitation and change, chained so alterations can be detected, and exports as a CSV.
  • Every upload is scanned for viruses, and nothing is served until the scan is clean.
  • Your team signs in through MyAndGo with Google, Microsoft or email and two-step verification, with session timeouts you can set.

On where documents are held and which other services are involved, our privacy policy sets this out. Whether a service is appropriate for a regulated entity's purposes is the entity's own judgement under its own framework.

Beyond the Reserve Bank

Other obligations sit alongside the Reserve Bank's guidance. Any entity holding personal information is covered by the Privacy Act, including principle 5's expectation of reasonable security safeguards, and the notifiable privacy breach scheme. The Reserve Bank also says it works with the National Cyber Security Centre and the Financial Markets Authority on cyber resilience, including information gathering and sharing arrangements.

Questions people ask

When did the Reserve Bank publish its cyber resilience guidance?
The Reserve Bank says it published its cyber risk management guidance in April 2021 for all the entities it regulates.
How quickly must material cyber incidents be reported to the Reserve Bank?
The Reserve Bank says registered banks, non-bank deposit takers and insurers must report material cyber incidents as soon as practicable, but within 72 hours.
Is the guidance a detailed technical checklist?
No. The Reserve Bank describes it as high-level, principle-based recommendations that entities can tailor to their own needs and technologies.

Related reading

How ShareAndGo protects documents

Verified recipients, watermarked view-only sharing, virus scanning and a chained audit log.

Zero trust for document sharing

Verifying every person and limiting every permission.

Tamper-evident audit trails, explained

What a chained activity record shows.