Loading component...

Security assurance

Preventing and managing risk

Security assurance is about preventing and managing Information Technology (IT) security risks for the services that use, store, and transmit information. It ensures compliance with industry standards and implementation of the right security policies to keep information secure.

The Security Assurance team are responsible for assessments and assurance activities including the secure design and development of services, control testing, IT risk management, and third-party risk assessments.

Loading component...

Control uplift
Increasing the maturity and effectiveness of a security control.

IT risk
The possibility that an IT system has a breach or other failure that leads to data loss, data integrity issues, or is unavailable. Risk is quantified in terms of likelihood and consequence. Most organisations have a ‘risk appetite’, which is the level of risk the organisation is prepared to accept. High likelihood and high consequence risks are never accepted, while low likelihood and low consequence risks may be completely acceptable unless they are easy to address.

IT systems
IT services and applications that support a set of business processes, and store and manage information.

Penetration testing
An intensive testing process where an expert in security testing (or “hacking”) techniques attempts to breach an IT system. This helps identify vulnerabilities that can be addressed before a malicious person finds them.

Personal Identifiable Information (PII)
Information about an identifiable individual, such as a member, employee, provider or adviser, governed by New Zealand’s privacy laws and (where it contains health information) the Health Information Privacy Code.

Security control
A safeguard or measure that we’ve implemented to avoid, detect or minimise security risks to data, business applications, systems or physical property.

Third-party provider
An external partner, vendor, consultant, or an independent contractor that provides specialised products, services and other expertise to Southern Cross.

Loading component...

Secure design and development

The Security Assurance team provides input into the design and implementation of IT systems. They identify the security requirements during the project planning phase, to ensure security is incorporated throughout all phases of design and development. This allows security to be tracked and tested at every stage until deployment. For more details on how we integrate security into the design and development of our IT systems, visit Security systems and information.

Loading component...

Classifying information

We collect, use, and store information for the purposes stated in our Member Privacy Statement. We hold Personal Identifiable Information (PII) and Personal Health Information (PHI) on behalf of our members and this is classified as Confidential and Highly Protected data.

Loading component...

Classification of IT systems by criticality

By understanding the availability and resilience requirements of our information systems, we can gain comfort that the digital services we provide to our members will continue to operate in the event of a disaster or business disruption. To help us to do this we:

identify our critical information systems
understand vulnerabilities
perform risk assessments to understand the likelihood and impact of threats to the confidentiality, privacy, availability, and integrity requirements for systems and the data they handle

Loading component...

IT risk management

When IT risks are identified, we analyse and evaluate those risks to understand the severity and impact. Each risk is entered into our risk management system along with an assessment of the seriousness of the risk, and they are prioritised, assigned a due date, and tracked through to resolution.

If the risk falls within Southern Cross’ risk appetite - the level of risk we’re prepared to accept - then we may formally accept the risk. A risk resolution is documented, and the closure of a risk is only confirmed with the approval of a manager.

Loading component...

Controls testing

We regularly perform a programme of security control testing, where we assess our IT systems against the security standards recommended in the Centre for Internet Security (CIS) framework. Individual security controls listed in the framework are assessed for effectiveness and resilience, and any issues and defects are identified. The results are made available to our auditors and reported to the Board and management.

The issues and defects we identify are addressed by a variety of control uplift activities, including:

implementation of new security measures
secure configuration of IT systems
documentation of improved processes
security training and awareness

Loading component...

Loading component...

Security testing

We thoroughly security test our IT systems and applications on a regular basis. For example, we might employ an independent security consultancy to perform penetration testing. This helps detect possible security risks and validates that the security controls are working exactly as they should be.

Third-party assessments

We employ reputable third-party providers to manage some of our IT systems. As their systems may be located outside the Southern Cross environment, we perform a risk assessment on each third-party provider and on the services they offer. Risk assessment aims to ensure:

Southern Cross’ information assets are not exposed to any undue risks
the third-party provider meets compliance requirements
the third-party provider has also implemented policies and processes to maintain the security of their services

For more information on the types of services we use, and how we assess and approve third parties, see Third-party service providers.

In this section

Loading component...

Security assurance

Preventing and managing risk

Loading component...

Glossary

Loading component...

Secure design and development

Loading component...

Classifying information

Loading component...

Classification of IT systems by criticality

Loading component...

IT risk management

Loading component...

Controls testing

Loading component...

Loading component...

Security testing

Third-party assessments

Loading component...

Related information

Security governance

Security systems and information

What we offer

Who we're for

Important information

Quick links

Help links

In this section

Preventing and managing risk

Glossary

Secure design and development

Classification of IT systems by criticality

IT risk management

Controls testing

Third-party assessments

What we offer

Who we're for

Important information

Quick links

Help links

Loading component...

Loading component...

Loading component...

Loading component...

Loading component...