New Zealand Information Security Manual (NZISM) 18.6.9.C.01: EAL2 or PP switch between NZEO and non-NZEO systems

What does 18.6.9.C.01 require?

Where agencies access a system holding NZEO information and a same-classification system not accredited for NZEO information, they must use an evaluated product assured to EAL2 or higher, or to a PP.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 18: Network security – New Zealand Information Security Manual (NZISM)

18.1.10.C.01 18.1.10.C.01 Network configuration controlled by a management authority
18.1.10.C.02 18.1.10.C.02 Formal change control for configuration changes
18.1.10.C.03 18.1.10.C.03 Regular review of network against documented configuration
18.1.10.C.04 18.1.10.C.04 Automated comparison of running and documented configuration
18.1.11.C.01 18.1.11.C.01 High-level and equipment network diagrams for every network
18.1.12.C.01 18.1.12.C.01 Keep classified network diagrams current and dated
18.1.12.C.02 18.1.12.C.02 Update network diagrams and date every page
18.1.13.C.01 18.1.13.C.01 Network access controls on all classified networks

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls