[IN-CONFIDENCE - RELEASE EXTERNAL] 
 
 
11/02/2026 
Phillip Fry  
[FYI request #33342 email] 
Tēnā koe Phillip 
OIA: [GEMS-46442] – Phillip Fry – Security and Privacy Compliance for SMART assessment tool 
Thank you for your email of 22 December 2025 to the Ministry of Education (the Ministry), and 
subsequent clarification of 28 January 2026 requesting the following information:  
•  A copy of the most recent Security Certification and Accreditation (C&A) report or security 
assurance document relied upon by the Ministry for SMART. 
•  A copy of the Privacy Impact Assessment (PIA) for SMART, including any sections addressing 
data sovereignty risks and the use of written authorisation under clause 16.3(d) of the ICT 
Services Agreement. 
•  Copies of any formal advice, assurance, or assessment received from the GCSB / National 
Cyber Security Centre relating to offshore backup storage or NZISM compliance for SMART. 
Your request has been considered under the Official Information Act 1982 (the Act). 
The Ministry needs to extend the timeframe for responding to your request, pursuant to section 
15A(1)(b) of the Act, as consultations necessary to make a decision on your request are such that a 
proper response cannot reasonably be made within the original time limit. You can now expect to 
receive a response to those parts of your request on or before 11 March 2026, which is an extension of 
20 working days. 
You have the right to ask an Ombudsman to investigate our decision to extend the timeframe for 
responding to this request, in accordance with section 28 of the Act. You can do this by writing to 
[email address] or Office of the Ombudsman, PO Box 10152, Wellington 6143. 
Nāku noa, nā 
 
 
Kelly Jensen 
Senior Advisor, Official and Parliamentary Information 
Government, Executive and Ministerial Services 
Wellington National Office, 1 The Terrace, Levels 5 to 14, Wellington 6011 
PO Box 1666, Wellington 6140, DX SR51201 Phone: +64 4 463 8000  
[IN-CONFIDENCE - RELEASE EXTERNAL] 

---