New Zealand Information Security Manual (NZISM)

Chapter 21: Distributed Working – New Zealand Information Security Manual (NZISM)

New Zealand Information Security Manual (NZISM) 21.4.10.C.06: 21.4.10.C.06 Offboarding removal of agency software and data

Procedures must be in place to remove agency-installed software and all agency data from a device when the user no longer needs BYOD, is redeployed, or leaves employment (off-boarding).

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 21: Distributed Working – New Zealand Information Security Manual (NZISM)

21.1.10.C.01 21.1.10.C.01 Policy for mobile device use
21.1.10.C.02 21.1.10.C.02 No TOP SECRET on mobile devices without GCSB approval
21.1.10.C.03 21.1.10.C.03 Deploy a Mobile Device Management solution
21.1.11.C.01 21.1.11.C.01 Tell staff the classification limits for mobile use
21.1.11.C.02 21.1.11.C.02 Avoid paging, SMS and MMS for sensitive traffic
21.1.12.C.01 21.1.12.C.01 Apply BYOD controls to non-agency devices
21.1.13.C.01 21.1.13.C.01 Handle unencrypted-to-lower devices as classified assets
21.1.13.C.02 21.1.13.C.02 Keep encryption access codes away from the device

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls