New Zealand HISF 2022

Why does it matter?

HISF gives Health New Zealand and the organizations around it one shared way to talk about cyber security: four obligations everyone accepts, a requirement set sized to each segment and a maturity scale for reporting progress. Section 2 treats all personal health information as MEDICAL IN CONFIDENCE, with an equal level of protection unless it is classified otherwise. Section 5 asks participants to acknowledge their obligations, assess themselves and share their maturity, so Te Whatu Ora and other stakeholders can measure and manage security uplift across the sector.

Key benefits include:

• Shared obligations

Section 5.1 applies Te Tiriti o Waitangi, confidentiality, integrity and availability to every organization handling personal health information, including Māori data and the exercise of kaitiakitanga over it.

• Requirements sized to the organization

The section 5.3 segmentation model groups organizations by information value, volume, surface area and architecture risk, so a small practice and a hospital do not carry the same requirements.

• A scale for reporting maturity

Section 5.3.2 rates each requirement from 1 (None) to 5 (Embedded), giving organizations and Health New Zealand a common measure of progress.

• Mapped, not duplicated

Section 5.4 maps requirements to NZISM, CIS, the CSA Cloud Controls Matrix, ISO 27002, ISO 27799, HIPAA, PSR and the CERT NZ Top Ten instead of reproducing them, and the mappings are updated periodically.

• Co-designed with Māori

Section 4 commits to Māori co-design in producing, maintaining and driving adoption of the framework, under the Ministry of Health's Te Tiriti o Waitangi Framework.

How does it work?

Section 5 lists seven foundational building blocks: Obligations, Functional Processes, Segmentation Model, Controls, Requirements, Guidance, and Tools and Templates. Four implementation support elements sit under them: marketing and user support, monitoring and measurement, maintenance and governance, and funding. The strategy is one pillar of Te Whatu Ora's three-year cyber security uplift program (2022-2024), organized in three workstreams: Leadership Capability and Assurance, Sector Protect, and Sector Detect, Respond, Recover.

The five functional processes (section 5.2) are adapted from the NIST Cybersecurity Framework, and section 5.5 groups the requirements under them. Plan covers establishing governance and having plans and policies in place. Identify covers identifying risk and determining capability. Protect covers people, process, technology and procurement risk. Detect covers testing safeguards, reviewing and updating, and monitoring for events. Respond covers activating plans, addressing vulnerabilities and recovering.

Section 5.7 adds tools and templates: checklists, guides and a self-completion questionnaire for each segment, where evidence for each requirement can support reporting and planning. The core document does not list the requirements itself. They sit in the segment guidance, where a segment's requirements and controls are set against the five functional processes. The requirements are high-level statements that act as a checklist for judging compliance status, and the document says the set is not exhaustive but extensible.

Key Elements

• Four obligations (5.1)

Te Tiriti o Waitangi, confidentiality, integrity and availability, applying to all organizations that collect, process or store personal health information about New Zealanders.

• Five functional processes (5.2, 5.5)

Plan, Identify, Protect, Detect and Respond, each with sub-categories such as people, process, technology and procurement risk under Protect.

• Segmentation model (5.3)

Segments with shared risk profiles, judged on information asset value or sensitivity, information volume, size of surface area and information security architecture risk.

• Maturity assessment scale (5.3.2)

A five-point scale from None to Embedded for rating how far each requirement or control is implemented.

• Controls and mappings (5.4)

Safeguards or countermeasures mapped to existing control catalogs, with requirements tailored by segment and maturity.

• Requirements, guidance, tools (5.5 to 5.7)

Plain-language requirements, living guidance documents and segment-specific toolkits that carry the detail the core document leaves out.

What does it cover?

Section 2 covers the security of all health information collected and used within New Zealand, wherever it is stored. The framework is the core document plus companion guidance for segments. The Health New Zealand cyber hub describes hospitals as public and private hospitals; micro to small organizations as those with two or more traits such as up to 25 staff, a population under 10,000, a single location and mostly outsourced IT; and medium to large organizations as those with more than 25 staff, a population over 10,000 or in-house software development. Suppliers and their sub-contractors have their own guidance. Privacy is outside the scope.

What are its objectives?

Section 1 describes the framework as a way to approach cyber security that health organizations and their industry partners can understand and adopt, and it ties HISF to sector investment goals.

Improve system resilience by addressing technology that is out of support and no longer fit for purpose.

Improve data and analytics capability so equity issues can be targeted more effectively.

Improve information sharing between providers to support collaboration and coordination of care.

Give New Zealanders more digital options for managing their own health and wellbeing.

Deliver the outcomes in section 5: better incident response and more visible reporting, trust in the sector's ability to secure information, and wider adoption of the framework.

Framework in Context

HISF began in 2009 with security essentials and policies, gained a technical specifications register in 2013 and was fully revised in 2015 to follow ISO. The 2022 edition replaces that ISO-centric model with one based on the NIST Cybersecurity Framework while still mapping to ISO 27002 and ISO 27799. It sits beside NZISM and the Protective Security Requirements, which it maps to, and beside the Health Information Privacy Code 2020 and the Privacy Act 2020, which the document lists among relevant legislation. The supplier guidance has its own page on NZ HISF Suppliers, and the government manual is covered at NZISM.

Common Framework Mappings

HISF maps its requirements to control catalogs instead of reproducing them. The document names NZISM, CIS, the CSA Cloud Controls Matrix, ISO 27002, ISO 27799, HIPAA, PSR and the CERT NZ Top Ten, and organizations commonly cross-walk to the frameworks below as well.

Mapped frameworks include:

HIPAA (NIST SP 800-66 Rev. 2)

HITRUST CSF v11.5

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

NZISM 3.6

PCI DSS 4.0.1