New Zealand Information Security Manual (NZISM) 18.1.9.C.01: Risk assessment before sharing network documentation externally

What does 18.1.9.C.01 require?

Before network documentation is handed to any third party, for example a contractor or commercial provider, agencies must carry out a security risk assessment.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 18: Network security – New Zealand Information Security Manual (NZISM)

18.1.10.C.01 18.1.10.C.01 Network configuration controlled by a management authority
18.1.10.C.02 18.1.10.C.02 Formal change control for configuration changes
18.1.10.C.03 18.1.10.C.03 Regular review of network against documented configuration
18.1.10.C.04 18.1.10.C.04 Automated comparison of running and documented configuration
18.1.11.C.01 18.1.11.C.01 High-level and equipment network diagrams for every network
18.1.12.C.01 18.1.12.C.01 Keep classified network diagrams current and dated
18.1.12.C.02 18.1.12.C.02 Update network diagrams and date every page
18.1.13.C.01 18.1.13.C.01 Network access controls on all classified networks

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls