New Zealand Information Security Manual (NZISM)

Chapter 22: Enterprise systems security – New Zealand Information Security Manual (NZISM)

New Zealand Information Security Manual (NZISM) 22.1.20.C.01: 22.1.20.C.01 GCSB approval for classified cloud use

For CONFIDENTIAL, SECRET and TOP SECRET systems, the GCSB must approve any use of cloud services or cloud infrastructure for systems and data held at the CONFIDENTIAL, SECRET or TOP SECRET level.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 22: Enterprise systems security – New Zealand Information Security Manual (NZISM)

22.1.20.C.02 22.1.20.C.02 Cloud providers apply NZISM controls to classified agency systems
22.1.20.C.03 22.1.20.C.03 No external cloud for CONFIDENTIAL and above
22.1.20.C.04 22.1.20.C.04 No public or hybrid cloud for NZEO information
22.1.20.C.05 22.1.20.C.05 Formal provider assurance of NZISM control application
22.1.21.C.01 22.1.21.C.01 Risk assessment before cloud adoption
22.1.21.C.02 22.1.21.C.02 Define trust boundaries before cloud implementation
22.1.21.C.03 22.1.21.C.03 Allocate control responsibilities between agency and provider
22.1.21.C.04 22.1.21.C.04 Executive and Accreditation Authority acceptance of cloud risks

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls