Wellington Supplier Cybersecurity Requirements - City Law
Wellington suppliers must understand how council procurement and contract terms address cybersecurity across Wellington, Wellington Region. This guide explains the council-level requirements and where to find the controlling procurement policy, what enforcement looks like, common compliance steps and how suppliers should prepare for audits, incident reporting and contractual cybersecurity clauses.
Council requirements & scope
The primary municipal source for supplier requirements is the Wellington City Council procurement and contracts guidance and the associated contract terms used for suppliers and contractors; specific cybersecurity expectations are included in contract clauses and procurement specifications rather than in a separate bylaw. See the council procurement guidance for contract terms and supplier obligations Procurement and contracts[1].
Penalties & Enforcement
The council enforces supplier cybersecurity obligations through contract remedies, compliance checks and procurement processes rather than a standalone city bylaw containing fixed fines; monetary penalties and exact enforcement steps are not specified on the cited page. The primary enforcer is the Wellington City Council procurement/contracting function supported by the council legal and ICT teams.
- Non-monetary sanctions: contract termination, suspension from future tenders, remedial directions, requirement to remediate vulnerabilities, withholding payments.
- Court and statutory actions: the council may pursue contractual damages or injunctive relief through the courts where appropriate.
- Inspection and compliance: the council may require security evidence, audits or on-site inspections by its ICT or procurement officers.
- Fines and fixed penalties: not specified on the cited page.
Escalation and repeat offences: the council typically escalates from remedial notices to suspension or termination for continued non-compliance; precise escalation criteria and timeframes are not specified on the cited page. Appeal or review routes are generally the contractual dispute resolution clauses (mediation, arbitration, or court) and any administrative review set out in the contract; explicit statutory appeal time limits are not specified on the cited page.
Applications & Forms
The council does not publish a standalone "cybersecurity form" for suppliers; cybersecurity requirements are implemented via procurement documents, standard supplier registration forms and contract schedules. Specific forms and submission methods for tenders and supplier onboarding are handled through the council procurement portal and tender documents—see procurement guidance for current application channels and any supplier registration systems.
Common violations and typical outcomes
- Failing to meet contract security clauses — remedial directions, likely suspension or termination.
- Poor recordkeeping or missing audit evidence — requests for additional evidence, audit, or corrective action.
- Failure to report a data breach in required timeframes — contractual breach, remedial action, possible legal claims.
Action steps for suppliers
- Review the procurement specification and contract schedule for explicit cybersecurity clauses and evidence requirements before bidding.
- Implement baseline controls: access management, patching, encryption for sensitive data, logging and retention policies.
- Prepare evidence packages: security policies, incident response plan, recent audit reports or certification statements.
- Designate a contact for security incidents and include it in contract communications and tender submissions.
FAQ
- Do suppliers need to submit a dedicated cybersecurity plan?
- Not usually as a separate council form; instead include required security statements, plans or evidence as requested in the tender or contract schedule.
- What should I do if a data breach affects council data?
- Follow your incident response plan, notify the council contact in your contract immediately and preserve evidence for investigation; specific notification timelines are governed by contract terms and relevant law.
- How can I report suspected non-compliance by another supplier?
- Report concerns to Wellington City Council procurement or the contract manager listed in the relevant contract; the council will investigate per procurement and contract processes.
How-To
- Read the tender and contract schedule to identify explicit cybersecurity clauses and evidence requirements.
- Assess your current controls against the requirements and create a remediation plan for gaps.
- Document policies, incident response procedures and designate a security contact for council communications.
- Submit required evidence with your tender or when requested during contract performance; keep records up to date.
- If an incident occurs, follow your response plan and notify the council immediately as required by the contract.
Key Takeaways
- Cybersecurity expectations are primarily set through procurement documents and contract clauses, not a separate city bylaw.
- Suppliers must provide evidence and comply with contract security schedules to avoid remedial action or termination.
- Prepare incident response and contact details before you bid and retain audit-ready records.
Help and Support / Resources
- Wellington City Council - Procurement and contracts
- Wellington City Council - Contact us
- Wellington City Council - Building and consents
- Wellington City Council - Homepage