New Zealand Information Security Manual (NZISM) 9.3.8.C.01: Inform staff of risks of posting personal information

What does 9.3.8.C.01 require?

Agencies should make sure personnel understand the security risks of posting personal information on websites, with particular emphasis for personnel who hold higher level security clearances.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Chapter 9: Personnel Security – New Zealand Information Security Manual (NZISM)

9.1.4.C.01 9.1.4.C.01 Management ensures system users are trained and security aware
9.1.5.C.01 9.1.5.C.01 Ongoing security awareness and training programme for personnel
9.1.5.C.02 9.1.5.C.02 Security awareness training included in staff induction
9.1.6.C.01 9.1.6.C.01 Tailor awareness training to user responsibilities
9.1.6.C.02 9.1.6.C.02 Required topics in security awareness and training content
9.1.6.C.03 9.1.6.C.03 Training warns users against prohibited system actions
9.1.7.C.01 9.1.7.C.01 TOP SECRET familiarisation training before unsupervised access
9.1.8.C.01 9.1.8.C.01 Caution staff on courses attended with non-government people

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All New Zealand Information Security Manual (NZISM) controls