New Zealand Information Security Manual (NZISM)
Chapter 16: Authentication and Access Controls – New Zealand Information Security Manual (NZISM)

New Zealand Information Security Manual (NZISM) 16.1.31.C.02: Annual password change where no MFA or passwordless

What does 16.1.31.C.02 require?

Agencies must apply a password policy that forces a password change at least every year on any system lacking both MFA and passwordless authentication.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Other controls in Chapter 16: Authentication and Access Controls – New Zealand Information Security Manual (NZISM)

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll New Zealand Information Security Manual (NZISM) controls