Kia ora tātou

Welcome to the May edition of the Government Chief Digital Office (GCDO) newsletter. It is great to be updating you about some of our key pieces of work since the last newsletter.

Two major milestones for the GCDO, Ministers Collins and Upston have recently announced the release of the NZ Verify /Whakatūturu app - a free and accessible app that can verify mobile (digital) driver licenses and other digital identity credentials. This is another building block in the development of a thriving digital identity ecosystem

We are also pleased to announce the first certification of a Public Cloud Data Centre. This provides New Zealand government agencies with the confidence that the public cloud data centres they use meets their security obligations and reduce ownership, control, and supply chain risks.

We have just launched our third online course "Biometrics 101" for those who are designing biometric processes or want to know how biometric recognition systems work. This standalone course will help to ensure consistent and good methods of identification management are applied to protect people from fraud and keep their information safe.

Sticking to the theme of cyber security and identification management, this edition also includes an article from the Office of the Auditor-General about the important roles governors play in supporting public organisations to understand cyber threats, set a clear risk appetite, and implement mitigations.

Lastly, Adobe's Asia Pacific branch released its latest Digital Government Index (DGI) for Aotearoa New Zealand report which evaluates digital government services on three dimensions: Customer Experience, Site Performance, and Digital Equity. New Zealand’s DGI score has improved from the last evaluation in 2023, stating that "New Zealand government’s digital strategies are paying off." Surely good news!

As always, so much other information, we hope you enjoy. We're keen to hear what else you'd like to hear about, so let us know and of course forward the newsletter to others. 

Ngā mihi

The GCDO

NZ Verify App is now live

Ministers Collins and Upston have announced the release of the NZ Verify /Whakatūturu app on iOS and Android. This is a free, accessible app that can verify that mobile (digital) driver licenses and other digital credentials are valid.

The release of the NZ Verify app is part of the Government’s commitment to a modern digital identity system based on digital credentials. This provides a secure and privacy-preserving way for New Zealanders to better prove who they are. NZ Verify ensures we’re prepared for the future, eventually enabling verification of digital credentials in everyday situations such as buying an age-restricted product or renting a car.

DIA has been promoting the future potential of digital identity and credentials on people’s phones for some time. That time is now here. With a legal framework now in place with the Digital Identity Services Trust Framework, the technology firming up around global standards, and now a freely available app to verify digital credentials, it is expected New Zealanders will have access to accredited digital credentials in the next 18 months.

GCDO and the Trust Framework will continue to implement infrastructure and initiatives that encourage agencies to issue and accept digital credentials as a form of identity. Additional information about the Trust Framework can be found here: Trust Framework - dia.govt.nz.

NZ Verify is now available for download via the New Zealand Apple Store and on the Google Play Store.

AI Policy Template (almost) Ready to Roll

The GCDO is not just about safe and responsible AI, it’s about enabling agencies. Over time, we are building a Public Service AI Toolkit for agencies that will include best practice examples of common collateral and core building blocks for agencies to begin or progress their safe and responsible uptake of AI.

As a part of this toolkit, agencies will soon be able to access a Public Service AI Policy Template. Born from seven of the best New Zealand agencies, policies from our international counterparts, and set against the GCDO AI Framework and AI Responsible Guidance for AI: Gen AI, this template is intended to get agencies 80-90% of the way there. This AI Policy will be a key piece of collateral that can be followed quickly with confidence yet still allows room for agency requirements. Those who are interested in receiving a copy of this policy please email gcdo@dia.govt.nz and we will send this out to you.

GCDO trialling responsible AI

GCDO is testing how AI can help New Zealanders to quickly and easily find the information they need from government.

We are piloting an AI assistant for the Govt.nz website that will provide personalised answers to questions about government services, and a more tailored experience when interacting with government information. This initiative concluded a proof-of-concept phase in 2024 and is continuing to be developed as a pilot. 

The AI assistant understands and responds to questions in a conversational way, using ‘Retrieval Augmented Generation’ to pull trusted content from multiple government websites to deliver a better user experience faster than traditional methods.

As part of this initiative, GCDO is using two different AI technologies to understand how different approaches could provide a better user experience for New Zealanders.

Adobe's Digital Government Index 2024 report

Adobe recently released its 2024 Adobe Digital Government Index report for Aotearoa New Zealand. The purpose of the report is to understand the user experiences of two main cohorts of customers of government services: The “average user” and those people either digital excluded or at risk of digital exclusion.  

The report’s findings note that New Zealand’s digital strategies are having the desired effect and have lifted the country’s DGI score of 2023 and that these digital strategies are effective as well as identifying opportunities where we can go further.

It is pleasing to see that agencies are scoring well in the assessment area that looks at citizen digital experience, highlighting that New Zealand’s focus on customer experience initiatives has generated an annual uplift in the overall score, particularly those customers with accessibility needs, stating “initiatives designed to deliver equitable and inclusive online government services are producing results.” 

Adobe Digital Government Index 2024 report for Aotearoa New Zealand 

AoG Digital Portfolio - Security and Resilience Activities

Centralised All of Government Digital security assurance has enhanced the Government’s overall security posture, as well as the security posture of major government suppliers. This reduces time, cost, and resources for the system. 

Digital suppliers and their services undergo certification activities, including Audits, and participate in ongoing security assurance activities to ensure compliance with New Zealand Government and international security requirements. 

Uplifting system resilience through the GCDO’s All of Government Digital Portfolio decreases the risk of disruption to public services, improves the security of government information, and helps maintain New Zealanders’ trust in government. Currently, 77% of the services available through the Portfolio are granted Tier 1 Security Assurance and Risk status, which confirms they are meeting New Zealand Government security requirements. 

We are always considering ways to improve the Portfolio. A recent improvement is the introduction of a Continuous Certification process that will provide a simplified, quicker, and less costly approach for security certification of ICT Common Capabilities, in alignment with modern international security assurance practices and process. This approach will enable ongoing and consistent visibility that key controls for information security risks are working effectively to protect agency systems and data.

Public Cloud Data Centre Certification

The GCDO has reached a significant milestone with the first Public Cloud Data Centre Certification (PCDCC).

The PCDCC initiative provides a standardised and consistent security assessment of onshore New Zealand Public Cloud Data Centres, that will provide agencies with confidence that the Public Cloud Data Centres they use meet security obligations and reduce ownership, control, and supply chain risks. It also streamlines the certification and accreditation processes for providers, reducing the effort required to meet agency certification requests.

The certification of Canberra Data Centres (CDC) Public Cloud facilities in Auckland marks a crucial step in enhancing the security and efficiency of government Cloud services.

This milestone supports GCDO’s digital transformation goals and demonstrates the Government's commitment to enhancing digital public infrastructure and supporting the transition of government systems into the Cloud. 

This initiative also aligns with the Government's Cloud First Policy, which requires government agencies and organisations to adopt Public Cloud services in preference to traditional ICT systems.

Biometrics course available now

Are you designing biometric processes? Are you interested in how biometric recognition systems work? If so, we have some quality, fundamental training to help you do it well.

The GCDO has just launched our third online course Biometrics 101. This course explains:

• What biometrics are 🔎
• How biometrics work⚙️
• How biometric information can be utilised to strengthen identification processes 🔒

Whether you are working in technology or just interested in the topic, you can gain a deeper understanding of identification management. This is key to reducing identity theft and its associated losses while also addressing security and privacy risks.

Biometrics 101 and its companion courses are available free of charge on the Public Service Core Learning Hub: LDC : Identification Capability

You can find more information on Identification training and clinics on Training and clinics for identification management | NZ Digital government

Office of the Auditor General publishes Cyber Governance article

Cyber threats are evolving, both in volume and sophistication. Recently the Office of the Auditor-General undertook a performance audit focusing on the governance of cyber risk and published an article about how effective cyber security is critical to the public sector's ability to maintain public trust and carry out its work.

The GCDO works with the National Cyber Security Centre and the Government Chief Information Security Officer to support digital government services within the public sector's cyber security system. 

You can find a copy of the article on OAG's website Mind the gap: Governing cyber security risks — Office of the Auditor-General New Zealand

Events and Communities

Digital Assurance Community of Interest

The Digital Assurance Community of Interest met recently in February to discuss “GCDO Expectations for Digital Investment”.

This is a community of interest for digital assurance. It is led by the GCDO and assurance practitioners. It provides a forum to understand core and common risk and assurance concerns, new practices, and emerging risk landscapes.

We intend to meet online every couple of months and are hoping that our next session will be towards end of May.

If you would like to broaden your connections with wider public sector Digital Assurance practitioners, then you may want to be part of the Digital Assurance Community of Interest.

Let your risk management and assurance leads/teams know about this group. They can request to attend by emailing gcdo@dia.govt.nz with “Interest in DACOI” in the subject line.

International trends in digital government

We will look at international jurisdictions over the coming newsletters to keep you up to date with trends and insights relating to digital government.  

Report from World Bank Digital Public Infrastructure and Development: A World Bank Group Approach

This paper presents a one-World Bank Group framework for understanding and implementing Digital Public Infrastructure (DPI) to accelerate safe and inclusive digital transformation.