Cyber security, NZISM readiness and assurance consulting

Security work should end in a decision

Hot Desk helps New Zealand organisations review security architecture, assess readiness and prepare evidence for an authorised security decision. Start with the system or change in scope, the risks that matter and the decision-maker who must accept the remaining risk.

A long control checklist is not useful if leaders still cannot tell whether a system should proceed, which gaps need attention or who must address them. We connect the technical evidence to those decisions.

What we review

• Security architecture for digital services, cloud platforms and integrations
• Technical risk, threats, control design and remediation options
• SaaS, Azure, AWS and supplier assurance material
• Control-validation plans, audit evidence and risk reporting
• Material prepared for Certification and Accreditation or Authority to Operate decisions

The exact work depends on the system, the change being considered and the authority that must make the decision.

Security compliance and readiness

If you are preparing for an NZISM assessment, an ISO/IEC 27001 review or an internal security decision, we can assess the current position, test the evidence and build a practical remediation plan with clear owners.

The work may include an NZISM assessment or ISO/IEC 27001 readiness review when those frameworks fit the scope. We provide readiness and assurance support; the client's authorised decision-maker retains approval responsibility.

What you can take into the decision

• A view of the system boundary, relevant threats and control gaps
• An evidence register that identifies what is supported, missing or still uncertain
• A prioritised remediation plan with responsible owners and dependencies
• Decision material that separates resolved issues from remaining risk

The exact outputs are agreed for the engagement. Readiness support is not certification, and the client's authorised decision-maker retains approval responsibility.

Experience across public-sector services

Hot Desk consultants have supported security assurance for cloud, SaaS, enterprise and on-premises services across several New Zealand public-sector engagements. The work included secure-design advice, architecture and control review, technical risk assessment, validation planning and audits, supplier review, remediation recommendations and decision material for senior leaders.

We have also connected cybersecurity architecture with IRM for an energy and utilities organisation operating across a complex multi-cloud environment. Parapet formed part of that engagement; it was not a product-selection exercise.

Frameworks we work with

Depending on the engagement, our work may draw on the New Zealand Information Security Manual, Protective Security Requirements, ISO/IEC 27001, SOC 2 assurance reports and the Privacy Act 2020. Team members can include ISO/IEC 27001 Lead Auditor and Certified Information Systems Auditor practitioners.

These are practitioner credentials rather than company certifications. Hot Desk does not issue certifications or make the client's final approval decision.

When specialist testing is needed

Our work focuses on security advice, architecture, assessment and assurance. If an engagement needs penetration testing, round-the-clock monitoring or incident response, we work with or review evidence from the appropriate specialist provider rather than presenting Hot Desk as that provider.

Discuss your security challenge, or explore related IRM, regulatory compliance and AI governance.