Developing a Citizen Cyber Resilience Index for New Zealand

This project is a collaboration between CERT NZ, Accenture Australia and BEST Centre @ QUT and aims to develop a citizen cyber resilience index for New Zealand.

Why is this important?

The threat of cyber-attacks and threats in Aotearoa is rising, causing increasing harm to not just businesses but also citizens. Whilst there has been a surge in government and academic interest in measuring and tracking cyber-security threats, including in Aotearoa, current approaches focus on the number of cyber incidents or the state of organisational/business cyber resilience. There is a resounding gap in the measurement of citizen-centric cyber resilience. This is particularly concerning given 3 in 4 New Zealand citizens reported in 2021 they do not know where or when to report a cyber-security breach (UNISYS Security Index, 2021). Previous Accenture research shows that citizens may also have heightened susceptibility to cyber threats due to behavioural factors including bias and heuristics. By exploring how these behavioural factors interact with citizen cyber resilience, and how these factors vary by persona/anti-persona, there is a great opportunity to develop a suite of targeted interventions informed by behavioural science to uplift citizen cyber resilience.

What we did

The research commenced with a rapid literature review to identify citizen-focused definitions, behaviours and practices of cyber resilience, factors in the cyber ecosystem that affect cyber resilience, measurement of cyber resilience and interventions that build cyber resilience. There are six research questions addressed by the literature review:

1. What is citizen cyber resilience?
2. What are the behaviours and practices of citizen cyber resilience?
3. What are the factors in the cyber ecosystem that affect citizen cyber resilience?
4. How can citizen cyber resilience be measured?
5. What framework can underpin citizen cyber resilience personas?
6. What are effective strategies for building citizen cyber resilience?

The second phase was the development of an index. This phase was conducted by Accenture.