New Zealand Information Security Manual (NZISM)

Chapter 23: Public Cloud Security – New Zealand Information Security Manual (NZISM)

New Zealand Information Security Manual (NZISM) 23.2.16.C.02: 23.2.16.C.02 Per-service cloud risk assessment following GCDO process

Before implementing or adopting public cloud services, agencies must carry out a cloud-specific risk assessment for each public cloud service, following the process set out by the GCDO.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 23: Public Cloud Security – New Zealand Information Security Manual (NZISM)

23.1.54.C.01 23.1.54.C.01 Identify classification, domain and trust zone boundaries for public cloud
23.1.54.C.02 23.1.54.C.02 Separate domain when multiple identity systems control access
23.1.55.C.01 23.1.55.C.01 Understand shared security responsibilities per cloud service
23.1.55.C.02 23.1.55.C.02 Document agency and provider security responsibilities
23.1.55.C.03 23.1.55.C.03 Align security processes with provider responsibilities
23.1.56.C.01 23.1.56.C.01 Infrastructure as code for cloud management
23.2.16.C.01 23.2.16.C.01 Update risk assessment process for public cloud risks
23.2.16.C.03 23.2.16.C.03 No accreditation of public cloud for classified data

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls