New Zealand Information Security Manual (NZISM) 9.2.13.C.01: No CONFIDENTIAL or above access without completed clearance

What does 9.2.13.C.01 require?

For systems or information classified CONFIDENTIAL or above, system users must not be given access until vetting has been completed and a formal security clearance has been granted.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 9: Personnel Security – New Zealand Information Security Manual (NZISM)

9.1.4.C.01 9.1.4.C.01 Management ensures system users are trained and security aware
9.1.5.C.01 9.1.5.C.01 Ongoing security awareness and training programme for personnel
9.1.5.C.02 9.1.5.C.02 Security awareness training included in staff induction
9.1.6.C.01 9.1.6.C.01 Tailor awareness training to user responsibilities
9.1.6.C.02 9.1.6.C.02 Required topics in security awareness and training content
9.1.6.C.03 9.1.6.C.03 Training warns users against prohibited system actions
9.1.7.C.01 9.1.7.C.01 TOP SECRET familiarisation training before unsupervised access
9.1.8.C.01 9.1.8.C.01 Caution staff on courses attended with non-government people

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls