New Zealand Information Security Manual (NZISM)

Chapter 1: About information security – New Zealand Information Security Manual (NZISM)

New Zealand Information Security Manual (NZISM) 1.1.69.C.01: 1.1.69.C.01 Retain records of non-compliance decisions and assessments

Agencies must keep a copy of the risk assessment that supports each decision to be non-compliant with baseline controls in the NZISM, and must maintain a record of those decisions.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 1: About information security – New Zealand Information Security Manual (NZISM)

1.1.64.C.01 1.1.64.C.01 Dispensations for baseline non-compliance granted by Accreditation Authority
1.1.65.C.01 1.1.65.C.01 Risk assessment supporting a non-compliance dispensation
1.1.66.C.01 1.1.66.C.01 Consult originating agency before classification non-compliance
1.1.66.C.02 1.1.66.C.02 Consult foreign government before NZISM non-compliance
1.1.67.C.01 1.1.67.C.01 Formal consultation for shared and All-of-Government systems
1.1.68.C.01 1.1.68.C.01 Annual review of non-compliance decisions
1.1.69.C.02 1.1.69.C.02 Recording residual risk from unimplemented recommended controls
1.2.15.C.01 1.2.15.C.01 Use current NZISM version for system design

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls