The proposed NZ Cyber Security Strategy has drawn a hard line: generators at 30MW or above and distributors managing more than 25,000 ICPs face mandatory obligations. At the same time, AI is accelerating attacks, with 65% of organizations suffering a breach in the past year, up 18%, with 83% reporting AI involvement. The threat is already inside the perimeter.

The real exposure isn't detection — it's recovery. This whitepaper from Everpure and CDOTrends shows why fragmented operational data, untested recovery plans, and mutable datasets leave NZ utilities unable to prove a clean restore when it counts. It maps a practical path forward, grounded in the NIST Cybersecurity Framework, before regulation or an incident forces the issue.

Key Takeaways:

• Compliance thresholds are already set — 30MW+ generators and 25,000+ ICP distributors need to move now.
• The critical gap is recovery, not detection — can you identify and restore clean operational data under pressure?
• AI has shrunk response windows; machine-speed recovery is no longer optional.
• Funding the data layer early underpins every other control in the stack.
• Waiting for an incident to force this work will cost more and leave you exposed to regulators and boards.