New Zealand Information Security Manual (NZISM)

Chapter 22: Enterprise systems security – New Zealand Information Security Manual (NZISM)

New Zealand Information Security Manual (NZISM) 22.1.20.C.03: 22.1.20.C.03 No external cloud for CONFIDENTIAL and above

For CONFIDENTIAL, SECRET and TOP SECRET systems, agencies must not place systems or data at those classifications in public cloud, hybrid cloud that includes a public element, or any other externally operated cloud service.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 22: Enterprise systems security – New Zealand Information Security Manual (NZISM)

22.1.20.C.01 22.1.20.C.01 GCSB approval for classified cloud use
22.1.20.C.02 22.1.20.C.02 Cloud providers apply NZISM controls to classified agency systems
22.1.20.C.04 22.1.20.C.04 No public or hybrid cloud for NZEO information
22.1.20.C.05 22.1.20.C.05 Formal provider assurance of NZISM control application
22.1.21.C.01 22.1.21.C.01 Risk assessment before cloud adoption
22.1.21.C.02 22.1.21.C.02 Define trust boundaries before cloud implementation
22.1.21.C.03 22.1.21.C.03 Allocate control responsibilities between agency and provider
22.1.21.C.04 22.1.21.C.04 Executive and Accreditation Authority acceptance of cloud risks

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls