New Zealand Information Security Manual (NZISM) 19.3.8.C.03: 19.3.8.C.03 Firewall assurance levels by connected network classification

Agencies must select gateway devices according to the table in this control whenever they join networks whose classifications differ, or networks sharing a classification but sitting in separate security domains. The table gives what you require and what the other party requires (PP means Protection Profile). Your network RESTRICTED and below: to UNCLASSIFIED, you EAL4 firewall, they N/A; to RESTRICTED, you EAL2 or PP firewall, they EAL2 or PP firewall; to CONFIDENTIAL, you EAL2 or PP firewall, they EAL4 firewall; to SECRET, you EAL2 or PP firewall, they EAL4 firewall; to TOP SECRET, you EAL2 or PP firewall, they consultation with GCSB. Your network CONFIDENTIAL: to UNCLASSIFIED, you consultation with GCSB, they N/A; to RESTRICTED, you EAL4 firewall, they EAL2 or PP firewall; to CONFIDENTIAL, you EAL2 or PP firewall, they EAL2 or PP firewall; to SECRET, you EAL2 or PP firewall, they EAL4 firewall; to TOP SECRET, you EAL2 or PP firewall, they consultation with GCSB. Your network SECRET: to UNCLASSIFIED, you consultation with GCSB, they N/A; to RESTRICTED, you EAL4 firewall, they EAL2 or PP firewall; to CONFIDENTIAL, you EAL4 firewall, they EAL2 or PP firewall; to SECRET, you EAL2 or PP firewall, they EAL2 or PP firewall; to TOP SECRET, you EAL2 or PP firewall, they EAL4 firewall. Your network TOP SECRET: to UNCLASSIFIED, you consultation with GCSB, they N/A; to RESTRICTED, you consultation with GCSB, they EAL2 or PP firewall; to CONFIDENTIAL, you consultation with GCSB, they EAL2 or PP firewall; to SECRET, you EAL4 firewall, they EAL2 or PP firewall; to TOP SECRET, you EAL4 firewall, they EAL4 firewall.