New Zealand Information Security Manual (NZISM) NZISM-1: NZISM Governance, Documentation, and Classification System
Comply with the New Zealand Information Security Manual (NZISM) administered by the Government Communications Security Bureau (GCSB) National Cyber Security Centre (NCSC) under the Government Chief Information Security Officer (GCISO) function. Apply the New Zealand Government Security Classification System: UNCLASSIFIED + IN-CONFIDENCE + SENSITIVE + RESTRICTED + CONFIDENTIAL + SECRET + TOP SECRET (per Cabinet Office Circular CO (18) 5). Maintain Information Security Documentation including Security Risk Management Plan (SRMP) + System Security Plan (SSP) + Incident Response Plan + Audit and Compliance Programme. Govern under the Protective Security Requirements (PSR) overseen by NZ Security Intelligence Service (NZSIS).
What else in your programme already covers this
This control maps to 237 controls across 97 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated
NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use
3.2.1 Account data storage is kept to a minimum through implementation of data retention and disposal policies, procedures, and processes that include at least the following: • Coverage for all locations of stored account data.