Network Security Review: A NZ Business Preparation Guide

Illustrative cover image; not a customer system or completed security assessment.

Prepare for a Network Security Review, Not an Unplanned Change

If you want to improve network security, start by defining what you need to understand. A business owner does not need to change firewall settings or collect everyone's passwords to prepare a useful review brief. Identify the person responsible for your systems and agree what information can be shared, with whom and through which approved channel.

This guide is a preparation checklist for Auckland and New Zealand businesses. It is not a configuration procedure, a security certification or a guarantee that a system is safe.

Describe the Business Concern

Write down the event or question that prompted the review. Examples might include uncertainty over a former supplier's access, difficulty identifying who supports a site connection, or a customer asking for evidence of your security arrangements. These are illustrative scenarios, not Bestcomm customer case studies.

Record which business activities depend on the systems being discussed. Include the consequences of interrupted access to email, phones, customer records or site connectivity. Avoid choosing a technical remedy before the cause and dependencies are understood.

Assemble an Inventory Without Sharing Secrets

Ask the responsible system owner for an up-to-date overview of devices, services and suppliers. For each item, record its purpose, owner, support contact and any known documentation gaps. Include temporary site connections and third-party services where relevant.

Do not put passwords, recovery codes, private keys or customer records into a general planning spreadsheet. An inventory should identify who can arrange authorised access, not disclose their credentials. Confirm the handling of any more sensitive technical details with your IT provider.

Useful questions for the review meeting include:

• Which devices and cloud services are in scope?
• Who approves access for staff, contractors and suppliers?
• How are joiners, role changes and leavers handled?
• Which systems are supported, and which support dates remain unknown?
• What evidence exists for recent maintenance and recovery checks?

Ask for Evidence, Not Just a Checklist Tick

Discuss multi-factor authentication, access permissions, updates, backups and network separation with the people responsible for the environment. Ask what is already in place, how it was checked and what exceptions remain. The National Cyber Security Centre provides official New Zealand guidance to support that discussion.

A dated record can help show what was checked, but it does not by itself establish that a control works or that all legal obligations have been met. If personal information is involved, ask the responsible privacy adviser to confirm the obligations and decisions that apply to the actual service and incident scenario.

For recovery, ask which systems and data are covered, whether restoration has been tested, what the result was and which dependencies remain. Do not run a restore against a production system simply to complete this checklist. Agree the test scope, permissions and safeguards with the system owner first.

Separate Findings From Implementation Approval

A useful review should distinguish observations, assumptions and unknowns. Ask for each finding to identify the affected business activity, evidence, priority, proposed owner and next decision.

If changes are proposed, request a plan that addresses dependencies, maintenance timing, user impact, acceptance checks and rollback. Changes to access, routing, Wi-Fi or security settings can disrupt legitimate work if dependencies have not been understood. Configuration and incident-response decisions should be made by appropriately qualified, authorised people for the actual environment.

For a suspected active incident, use your agreed incident-response process and current official reporting guidance rather than treating a general article as an emergency procedure.

Define a Useful Handover

Before commissioning work, agree the review's scope, exclusions, deliverables and fees. Ask who will own the findings afterwards and how unresolved questions will be followed up. A first review might produce an inventory, evidence gaps and a prioritised decision list rather than immediately changing every system.

For progress reporting, compare equivalent measures and periods. For example, a documented inventory gap being resolved is different from proving a reduction in incident risk. Keep unknowns visible instead of recording them as zero or complete.

Discuss the Scope With Bestcomm

Bring your business concern, system-owner contacts and non-sensitive inventory to a scoping conversation. See Bestcomm's cybersecurity and managed IT services, or contact us to discuss what is included before work begins.

A damaged fibre cable is a separate issue: emergency fibre response is for Greater Auckland only. Confirm availability directly; do not assume an attendance time or authorisation to repair network-owner equipment.

The aim of a preparation brief is a clearer set of questions and responsibilities, not a promise of a particular security outcome.