New Zealand Information Security Manual (NZISM)

Chapter 13: Media and IT Equipment Management, Decommissioning and Disposal – New Zealand Information Security Manual (NZISM)

New Zealand Information Security Manual (NZISM) 13.3.8.C.02: Encrypt media data before transfer to another location

What does 13.3.8.C.02 require?

When media is to be moved to another area or location, agencies should encrypt the data on it using, as a minimum, an Approved Cryptographic Algorithm (Section 17.2 lists these).

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 13: Media and IT Equipment Management, Decommissioning and Disposal – New Zealand Information Security Manual (NZISM)

13.1.10.C.01 13.1.10.C.01 Proportionate risk assessment before migration or decommissioning
13.1.10.C.02 13.1.10.C.02 Required elements of the migration risk assessment
13.1.10.C.03 13.1.10.C.03 Consider a Privacy Impact Assessment for migration
13.1.10.C.04 13.1.10.C.04 Identify and terminate related service and legal agreements
13.1.11.C.01 13.1.11.C.01 Contents of the system decommissioning plan
13.1.12.C.01 13.1.12.C.01 Identify retention policies and laws before archiving
13.1.12.C.02 13.1.12.C.02 Archive adequate system documentation on decommissioning
13.1.12.C.03 13.1.12.C.03 Archive software and data needed for recovery

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls