What does 3.3.6.C.03 require?

ITSMs should consult ICT project staff so that information security forms part of how IT equipment and software is evaluated, selected, installed, configured and operated.

New Zealand Information Security Manual (NZISM)...

Other controls in Chapter 3: Information security governance - roles and responsibilities – New Zealand Information Security Manual (NZISM)

3.1.8.C.01 3.1.8.C.01 Seniority of the agency head's delegate
3.1.8.C.02 3.1.8.C.02 Delegate understands residual risk consequences
3.1.8.C.03 3.1.8.C.03 Managing conflicts where small agencies cannot segregate duties
3.1.9.C.01 3.1.9.C.01 Agency head support for information security
3.2.10.C.01 3.2.10.C.01 CISO strategic security and risk program
3.2.10.C.02 3.2.10.C.02 CISO owns security communications plan
3.2.10.C.03 3.2.10.C.03 CISO establishes security risk management process
3.2.10.C.04 3.2.10.C.04 CISO aligns system policies with PSR and NZISM

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls