Meeting your cybersecurity compliance obligations shouldn't require a full-time compliance officer. CyberMark delivers structured compliance assessments and audit-ready reporting for NZ small businesses, covering the NZ Privacy Act 2020, HIPAA, GDPR, and AU Privacy Act 1988.
CyberMark provides structured compliance assessments against four major frameworks. Every assessment produces an audit-ready report with findings, evidence documentation, and a prioritised remediation roadmap.
New Zealand's primary privacy legislation governs how any organisation operating in NZ collects, stores, uses, and discloses personal information. The 2020 Act introduced mandatory breach notification obligations, meaning you must report a privacy breach to the Privacy Commissioner and affected individuals if it is likely to cause serious harm. Our assessment maps your current controls against the 13 Information Privacy Principles and identifies gaps before they become reportable incidents.
If your business handles US healthcare data, as a healthcare provider, business associate, or SaaS platform with US clients, HIPAA sets strict requirements around how Protected Health Information (PHI) is stored, transmitted, and accessed. Our HIPAA compliance assessment covers the Security Rule's administrative, physical, and technical safeguard requirements, and produces documentation suitable for business associate reviews.
The General Data Protection Regulation applies to any NZ business that processes personal data belonging to individuals in the European Union or United Kingdom, regardless of where your business is based. GDPR carries significant penalty exposure for organisations that cannot demonstrate lawful processing, adequate security controls, and documented data subject rights procedures.
If you handle personal information from individuals in Australia, the AU Privacy Act 1988 and its 13 Australian Privacy Principles (APPs) apply. Our assessment maps your controls against the APPs and provides the documentation you need to demonstrate compliance to Australian clients or partners.
Every framework assessment follows the same structured process and delivers the same core outputs. You receive more than a score, you receive a documented evidence package designed to satisfy an auditor or regulator.
Gap analysis — A clear mapping of your current controls against framework requirements, with gaps prioritised by risk level
Audit-ready report — Comprehensive documentation of findings, evidence collected, and control status
Remediation roadmap — Prioritised recommendations with specific, actionable steps your team or ours can implement
Expert guidance — Direct access to a cybersecurity professional who understands both the security controls and the regulatory language behind them
Annual reassessment eligibility — Frameworks evolve; our assessments are designed to be maintained, not one-off exercises
Compliance assessments start at $500 NZD per framework. Our Security + Firewall plan includes one annual framework assessment per company.
Achieving and maintaining cybersecurity compliance follows a consistent process regardless of which framework applies.
We review your current security environment against the framework's requirements. This surfaces gaps, identifies existing controls that already satisfy requirements, and gives us an honest baseline. Most assessments are completed within 2-3 weeks.
We produce your compliance report, structured to satisfy auditor and regulator requests, with evidence documented and findings written in plain language that your team can act on.
Our report includes prioritised remediation steps. Where required controls overlap with our managed security services, we can implement them directly through your existing CyberMark plan or advise your team on how to close gaps independently.
Compliance is not a one-time event. Regulations evolve, your business changes, and auditors expect evidence of ongoing control effectiveness. Annual reassessments keep your documentation current and your controls aligned with current requirements.
Here's how CyberMark's assessment maps to the five core areas your business needs to have covered.
This is why compliance assessment and managed security work best together. The controls that satisfy a compliance framework are the same ones a managed security service deploys and maintains.
It is about demonstrating that you meet a defined set of requirements at a point in time. It answers the question: "Can we prove we have the required controls in place?"
is about the ongoing operational effectiveness of those controls. It answers the question: "Are those controls actually working right now?"
A business can be compliant on paper and still suffer a breach, because a control was documented but never properly implemented. A business can have strong security but still fail a compliance audit, because the evidence wasn't documented in the format the framework requires. CyberMark bridges this gap. Our compliance assessments verify what's on paper, and our managed security services keep those controls operating continuously. The result is a business that is both compliant and genuinely protected.
Every person on your account operates from New Zealand. We understand the NZ Privacy Act 2020, the obligations it creates, and what "notifiable privacy breach" means in practice for a 15-person Wellington business. When your compliance question has a local nuance, you get an answer from someone who knows it.
Hiring a full-time compliance professional is out of reach for most NZ small businesses. A CyberMark compliance assessment gives you a structured, expert-produced report at a fraction of that cost starting at $500 NZD per framework.
Most compliance providers hand you a report and leave. CyberMark can implement the remediation steps directly through our managed security service, so your controls are running, not just documented.
Every CyberMark plan is month-to-month. If your compliance needs change, your plan changes with them. No exit fees, no penalty conversations.
If you need to demonstrate compliance across more than one framework for example, the NZ Privacy Act 2020 and GDPR we assess them together and identify overlapping controls. This reduces duplication and the cost of achieving both.
Choose the framework that applies to your business. Each assessment includes a full questionnaire, compliance officer review, and a detailed report.
Australian Privacy Principles (APPs) — tiered pricing per principle
| Principles | Price (NZD) | Saving |
|---|---|---|
| 1 principle | $750 | — |
| 2-4 principles | $650-$700 | 10-15% off |
| 5-9 principles | $600 | 20% off |
| All 13 APPs Best Value | $500 flat | ~$38 each |
Information Privacy Principles (IPPs) — tiered pricing per principle
| Principles | Price (NZD) | Saving |
|---|---|---|
| 1 principle | $750 | — |
| 2-4 principles | $650-$700 | 10-15% off |
| 5-9 principles | $600 | 20% off |
| All 13 IPPs Best Value | $500 flat | ~$38 each |
one-time audit
one-time audit
Need expert guidance on your compliance results? Book a one-on-one session with a certified compliance officer.
per hour
We assess your environment, map your controls against the relevant compliance framework, identify any gaps, and deliver a clear, actionable report to help you meet your compliance requirements.
Your chosen compliance framework is assigned to your account by our team.
Answer compliance questions at your own pace through your secure dashboard.
A compliance officer reviews your responses and provides expert assessments.
Receive a detailed PDF report with scores, risk heatmap, and actionable recommendations.
Everything you need to know about compliance assessments and reporting
In the context of cyber security compliance, the five core areas are: Identify (understanding your data and risk), Protect (controls that prevent breach), Detect (monitoring that finds threats), Respond (procedures for when something goes wrong), and Recover (restoring operations after an incident). CyberMark's assessments and managed services address all five.
First, you assess where the gaps are. Then you document your controls in a format auditors will actually accept. Then you fix what's missing. Then you keep it maintained as regulations change. Skip any one of those, and the others don't hold up.
Yes. The NZ Privacy Act 2020 applies to any organisation operating in New Zealand that holds personal information about individuals. It includes mandatory breach notification obligations. Depending on your clients and industry, HIPAA, GDPR, or the Australian Privacy Act may also apply.
A compliance assessment checks your controls against a specific framework HIPAA, GDPR, NZ Privacy Act and produces the paperwork auditors actually want to see. A security audit takes a wider look at your overall posture. Different questions, different outputs.
Start with the NZ Privacy Act 2020, which applies to almost every business operating here. From there, it depends on your clients: US healthcare means HIPAA, EU or UK customers means GDPR, and anything across the Tasman brings in the AU Privacy Act 1988.
Most assessments are completed within 2-3 weeks, though larger or more complex environments can run a little longer. At the end, you receive a full report covering findings, evidence documentation, and a prioritised remediation roadmap, everything you need to take the next step.
The businesses most exposed to regulatory risk are the ones that haven't had time to think about it yet. A free consultation takes 15-30 minutes, costs nothing, and gives you a clear picture of your compliance obligations and what it takes to meet them, whether you proceed with CyberMark or not.