IT security services
ISO 27001 Certified Cyber Security Services for New Zealand Businesses
OxygenIT assesses, hardens, monitors and certifies the security of New Zealand businesses of 20 to 200 staff. We are certified to ISO 27001 and ISO 42001 (as at May 2026), both independently audited, and have supported more than 100 New Zealand businesses since 2005.
Plenty of companies will sell you security software. Very few take responsibility for your entire security posture. That is the job this page describes.
Or call 0800 242 206
How OxygenIT secures a New Zealand business
We follow the same four steps for every client, and every decision is based on risk, impact and long-term protection.
1. Security risk assessment
We review your users, devices, cloud platforms, email, firewalls, backups, access controls and internal policies, and identify where you are exposed and where a disruption would hurt most.
2. Test for weak points
We scan and test your systems, then explain the results in plain language so you know exactly what needs attention.
3. Layered security controls
We strengthen identity management, enforce multi-factor authentication, refine firewall configuration, improve email filtering and deploy endpoint detection and response (EDR) across your devices.
4. Monitoring and response
Our managed SOC and EDR platforms watch for unusual behaviour, and alerts are reviewed by security specialists. If something suspicious appears, we investigate and isolate affected systems if needed.
Response targets apply during our staffed hours, 8.00am to 5.00pm, Monday to Friday, excluding New Zealand public holidays. After-hours cover is a paid add-on, and outside staffed hours there is a real gap. The full targets are in our published SLA.
For businesses anywhere in New Zealand
National cyber security guides
Start with cyber security in New Zealand: what SMBs need and what it costs. The guides below go deeper on each part, with our published prices where we sell the service.
Monitor and respond
Where our office is
Cyber security services in Christchurch
Our office is at 7 Horner Street, Papanui, Christchurch. These eleven service pages were written for Christchurch businesses and describe each service as we run it from there. Clients outside Christchurch get the same services, delivered remotely.
Cybersecurity and antivirus, Christchurch
Managed endpoint protection and threat prevention for your devices.
Endpoint detection and response, Christchurch
EDR that tracks behaviour on laptops, desktops and servers to catch what traditional antivirus misses.
Managed SOC, Christchurch
A security operations centre for threat detection, prioritisation and response, to the targets in your service agreement.
Email protection, Christchurch
Filtering for phishing, fake invoices, spam and malware attachments.
Dark web monitoring, Christchurch
Alerts when staff credentials turn up in breach data, so a leaked password does not become a breach.
Security awareness training, Christchurch
Training that helps staff recognise phishing and social engineering before they click.
Vulnerability assessments, Christchurch
Scans of your network, endpoints and cloud, with a prioritised, plain-English fix list.
Penetration testing, Christchurch
Controlled, hands-on testing of networks, web applications and cloud environments.
IT compliance, Christchurch
Aligning your controls with ISO 27001, the NZ Privacy Act and industry obligations, with audit-ready documentation.
Virtual Chief Security Officer, Christchurch
Executive-level security direction and governance without a full-time hire.
Data backup and disaster recovery, Christchurch
Automated, monitored backups and a structured recovery process.
Our certifications and the frameworks we work with
OxygenIT is certified to ISO 27001 for information security and ISO 42001 for AI management (as at May 2026). Both are independently audited, and cover our internal processes, data handling, incident response and service delivery.
Beyond our own certifications, we help clients meet theirs:
- ISO 27001 readiness assessments and implementation support
- SMB1001 certification, from Bronze to Gold (published prices)
- NZ Privacy Act 2020 compliance, including mandatory breach notification processes
- NIST, the Essential Eight and CIS Controls
- Industry-specific frameworks, such as NZLS requirements for law firms and CA ANZ expectations for accountants
Our licensing, insurance and credentials page sets out what to ask any provider, including us.
What our cyber security services cost
Every price is published. NZD excluding GST.
| Service | Price |
|---|---|
| Cyber security audit | $4,500 to $10,000 per audit |
| Vulnerability assessment | about $1,500 per 10 staff |
| SMB1001 certification, Bronze | from $525 a month (10 users) |
| SMB1001 certification, Gold | from $1,425 a month (10 users) |
| Managed IT Support, including managed EDR, MFA enforcement, email filtering and awareness training | from $1,200 a month (up to 10 users) |
| Fully Managed IT, adding SOC monitoring or MDR and compliance work | from $3,600 a month (up to 10 users) |
Remediation found by an audit or assessment is quoted separately. Every band and team size is on the pricing page.
Frequently asked questions
What is included in an IT security assessment?
An IT security assessment reviews your systems, users, cloud platforms, email, backups and access controls. You receive identified risks, prioritised vulnerabilities, compliance gaps and a practical action plan.
How often should penetration testing be done?
Most businesses should complete penetration testing at least annually. You should also test after major system changes, new cloud deployments, or when a compliance requirement calls for it. Regular testing helps uncover new weaknesses before attackers find them.
What does EDR protect against?
Endpoint detection and response protects devices against ransomware, malware, suspicious behaviour and unauthorised access. It watches activity on each device, detects threats early, and isolates affected systems to stop threats spreading across your network.
Do you offer fully managed IT security services?
Yes. We provide fully managed IT security services including monitoring, threat detection, response, compliance support and ongoing improvement. Response targets apply during our staffed hours, and after-hours cover is a paid add-on.
What compliance standards do you support?
We work with ISO 27001, SMB1001, NIST, the Essential Eight and the NZ Privacy Act 2020. We review your current controls, highlight weaknesses and recommend clear improvements, so you are prepared for audits and meet recognised security benchmarks.
Take control of your security before it becomes a problem
Fifteen minutes with Tim is the way in. If it looks like a fit, a 45-minute discovery call and the scoping work follow, and all three are free.
Or call 0800 242 206
