What does 3.5.4.C.03 require?

A system user who, for any reason, has to bypass security policies, procedures or mechanisms must get formal authorisation from the CISO, or from the ITSM where that authority has been specifically delegated to the ITSM.

New Zealand Information Security Manual (NZISM)...

Other controls in Chapter 3: Information security governance - roles and responsibilities – New Zealand Information Security Manual (NZISM)

3.1.8.C.01 3.1.8.C.01 Seniority of the agency head's delegate
3.1.8.C.02 3.1.8.C.02 Delegate understands residual risk consequences
3.1.8.C.03 3.1.8.C.03 Managing conflicts where small agencies cannot segregate duties
3.1.9.C.01 3.1.9.C.01 Agency head support for information security
3.2.10.C.01 3.2.10.C.01 CISO strategic security and risk program
3.2.10.C.02 3.2.10.C.02 CISO owns security communications plan
3.2.10.C.03 3.2.10.C.03 CISO establishes security risk management process
3.2.10.C.04 3.2.10.C.04 CISO aligns system policies with PSR and NZISM

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls