New Zealand Information Security Manual (NZISM) 17.3.6.C.01: Allow only approved protocols in protocol-capable products

What does 17.3.6.C.01 require?

Where a product implementing an Approved Cryptographic Protocol is in use, agencies must make sure that nothing other than Approved Cryptographic Protocols can be used.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 17: Cryptography – New Zealand Information Security Manual (NZISM)

17.1.51.C.01 17.1.51.C.01 Cryptographic products must hold a GCSB-recognised evaluation
17.1.52.C.01 17.1.52.C.01 Data recovery capability in cryptographic products (classified systems)
17.1.52.C.02 17.1.52.C.02 Data recovery capability in cryptographic products
17.1.53.C.01 17.1.53.C.01 Encryption for reduced handling needs uses approved algorithms
17.1.53.C.02 17.1.53.C.02 HACE required to reduce handling of classified media
17.1.53.C.03 17.1.53.C.03 Full or partial disk encryption for classified equipment
17.1.53.C.04 17.1.53.C.04 Full or partial disk encryption for reduced handling
17.1.54.C.01 17.1.54.C.01 Approved algorithm to protect NZEO data at rest

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls