Rapid review of Police IT security controls released

A rapid review of Police IT systems and devices has found while Police have a wide range of security measures in place, there are opportunities to strengthen and tighten controls on their use.

The review found Police has a range of modern security controls which protect Police information and systems from malicious activity, with most user activity logged in line with good industry practice and with clear guidance and expectations for staff around acceptable use. 

However, the review also identified several areas where improvement was needed. These include more monitoring of staff internet use and stronger filtering mechanisms to guard against inappropriate or harmful content being accessed or downloaded.

It also recommended better oversight of all Police-owned devices, including those that sit outside the Police network for legitimate work purposes.

“Police is an extremely complex workplace and different levels of security settings will always be required by some staff for lawful policing purposes. Some staff also require devices that operate outside the central Police system,” said Police Commissioner Richard Chambers

“However, the review has made it very clear the current settings are not robust enough and urgent attention is required.”

The report includes recommendations to strengthen the settings.

Commissioner Chambers has confirmed two decisions to be actioned immediately:

– the reintroduction of audits of data and internet usage on police devices, a process that was halted four to five years ago. These will recommence as soon as possible.

– initiation of an assessment of Police-owned standalone devices which operate outside the Police network. While there are legitimate work reasons for such devices, clarity is needed around the oversight of them, the Commissioner said.

“I have requested a remediation plan to consider the review’s recommendations and address key issues. I have asked this be done quickly and expect to make further decisions within the month,” he said.

The 4-page NZ Police Rapid Review Summary Report can be read here.

The Commissioner’s statement announcing the review on May 16 can be found here.