File photo. Photo: 123RF The quality of DHB cyber defences has been questioned after a ransomware attack on Waikato hospitals in May. Several dozen government agencies are required by Cabinet to follow a programme in which the spy agency sets out all sorts of security requirements - but not DHBs. The SIS said it is up to Cabinet what agencies are mandated to follow the Protective Security Requirements (PSR). It gives DHBs advice anyway, and what they do is consistent with that. "The NZSIS has not, however, sought to have DHBs included in the PSR mandate," the SIS told RNZ.