PRACTICAL INFORMATION GOVERNACE
Make your information an asset — not an unmanaged risk.
subRoutine helps New Zealand organisations govern information, technology and emerging AI responsibly.
Drawing on extensive expertise, partnerships and recognised frameworks including NIST and ISO/IEC 27001, we turn governance requirements into practical policies, controls, evidence and decision-making systems.
NIST CSF 2.0
ISO/IEC 27001
PRIVACY
AI GOVERANCE
INFORMATION RISK
GOVERNANCE THAT WORKS
Information governance
that operates in the real
organisation.
Information Governance is how an organisation makes reliable
decisions about the information it creates, holds, uses, shares and
protects.
It connects people, processes, technology and accountability.
Done well, it supports better decisions, stronger cybersecurity,
responsible use of AI, regulatory compliance and trust.
We help you move beyond policies that sit on a shelf.
THE CHALLENGE
When governance
becomes
disconnected from
reality
Many organisations have policies, risk
registers and compliance obligations, but
lack a reliable way to connect them with
everyday operations.
02
04
01
03
Uncontrolled use of AI
Fragmented risk
management
Unclear accountability
Policies without evidence
AI tools are being adopted faster than
organisations can establish appropriate
oversight and accountability.
People are unsure who owns information,
technology risks, controls and important
decisions.
Policies exist, but it is difficult to
demonstrate that their requirements
are consistently followed.
Cybersecurity, privacy, records and
operational risks are managed
separately despite affecting the same
information.
Good governance makes these relationships visible, manageable and auditable.
WHAT WE DO
Connected
governance for
information and
technology
We design and implement governance
systems suited to your organisation’s
size, risk profile and responsibilities.
01
Create clear accountability for information throughout its lifecycle — from creation and
use through to retention and disposal.
Information Governance
02
Align cybersecurity responsibilities, risks and controls with recognised frameworks
such as NIST CSF 2.0 and ISO/IEC 27001.
Cybersecurity Governance
03
Understand what sensitive information you hold, where it moves, why it matters and
how its risks should be managed.
Privacy & Information Risk
04
Establish practical oversight for selecting, approving and using AI systems responsibly.
AI Governance
05
Build reliable evidence, reporting and review processes that support audits, customer
assurance and governance decisions.
Assurance & Compliance
FRAMEWORKS WITH PURPOSE
Recognised frameworks,
applied intelligently.
Frameworks provide valuable structure, but they are not an outcome by themselves. We
use NIST CSF 2.0 and ISO/IEC 27001 to create governance arrangements appropriate to
the organisation.
The objective is not compliance theatre. It is a system that clarifies responsibility, manages
material risk and produces trustworthy evidence.
NIST
Cybersecurity Framework 2.0
ISO/IEC 27001
Aligned to recognised frameworks. Certification is not implied.
ISO
Frameworks provide valuable structure, but they are not an outcome by themselves. We
use NIST CSF 2.0 and ISO/IEC 27001 to create governance arrangements appropriate to
the organisation.
The objective is not compliance theatre. It is a system that clarifies responsibility, manages
material risk and produces trustworthy evidence.
OUR APPROACH
From governance requirements
to working practices
1
2
3
4
Understand
Design
Implement
Assure
Put the agreed practices into operation
with the people who will own and use
them.
Establish evidence, monitoring and
review so leaders can see whether
governance is working.
Develop proportionate responsibilities,
policies, controls and reporting.
Clarify the organisation’s context,
information, obligations, stakeholders
and material risks.
The result is governance embedded in everyday operations — not
another collection of documents.
SPECIALIST EXPERTISE
A practical perspective,
grounded in Information
Governance.
subRoutine combines Master’s-level expertise in Information Governance with practical
experience across information systems, cybersecurity, risk and organisational operations.
This perspective connects recognised frameworks with the realities of how people,
information and technology interact — helping organisations make defensible decisions and
establish controls that work.
WHAT CHANGES
Clear ownership and accountability
A reliable view of material information risks
Policies and controls people can understand and use
Evidence that important controls are operating
More confident board and leadership reporting
More responsible adoption of AI and emerging technology