Proposed cybersecurity law targets prevention, with drafting still ahead

A new cybersecurity statute remained a proposal in the government’s 2 October update. Officials described research already undertaken but said Cabinet approval for drafting instructions, legislative review and other steps still lay ahead.

The planned approach would focus on securing systems before a breach. A July ministerial outline had envisaged protection of critical infrastructure, minimum standards, incident reporting and oversight of cybersecurity providers. Those are proposed features, not a verified schedule of obligations already in force.

The October explanation expressly distinguished the project from the Cybercrimes Act and characterised a two-year route as an aspiration. Organisations should therefore avoid converting the earlier programme milestones into fixed compliance dates.

Both official updates reviewed. The October account is later than the July programme and expressly describes remaining approvals. This report does not verify commencement or detailed coverage of the separate Cybercrimes amendments.