What does 3.3.8.C.04 require?

ITSMs should provide leadership and direction for bringing information security strategies and architecture together with the agency's business and ICT strategies and architecture.

New Zealand Information Security Manual (NZISM)...

Other controls in Chapter 3: Information security governance - roles and responsibilities – New Zealand Information Security Manual (NZISM)

3.1.8.C.01 3.1.8.C.01 Seniority of the agency head's delegate
3.1.8.C.02 3.1.8.C.02 Delegate understands residual risk consequences
3.1.8.C.03 3.1.8.C.03 Managing conflicts where small agencies cannot segregate duties
3.1.9.C.01 3.1.9.C.01 Agency head support for information security
3.2.10.C.01 3.2.10.C.01 CISO strategic security and risk program
3.2.10.C.02 3.2.10.C.02 CISO owns security communications plan
3.2.10.C.03 3.2.10.C.03 CISO establishes security risk management process
3.2.10.C.04 3.2.10.C.04 CISO aligns system policies with PSR and NZISM

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls