Back to Frameworks

New Zealand Information Security Manual (NZISM)

Self-Assess
New Zealand (GCSB / NCSC; published by the GCISO)
vv3.9 (released 9 May 2025; content of the print of 30 April 2025)
23 domains
1425 controls

The New Zealand Government's information security manual, published by the GCISO and maintained by the GCSB's National Cyber Security Centre: 1,425 controls across 23 chapters, each with a control identifier, a classification scope (All Classifications or CONFIDENTIAL, SECRET and TOP SECRET) and a compliance level (MUST, MUST NOT, SHOULD, SHOULD NOT), covering governance and roles, certification and accreditation, security documentation, monitoring, incidents, physical and personnel security, infrastructure and cabling, communications devices, product and media security, software, email, authentication and access, cryptography, network and gateway security, data management, distributed working, enterprise systems and public cloud. Built at control level from the v3.9 content (released 9 May 2025), read in full.

Verified

New Zealand Information Security Manual (NZISM) is a compliance framework from New Zealand (GCSB / NCSC; published by the GCISO) with 23 domains and 1425 controls that map to 135 other frameworks. The largest domains are Chapter 18: Network security – New Zealand Information Security Manual (NZISM) (118 controls), Chapter 11: Communications Systems and Devices – New Zealand Information Security Manual (NZISM) (114 controls), Chapter 16: Authentication and Access Controls – New Zealand Information Security Manual (NZISM) (101 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (23)

Chapter 10: Infrastructure – New Zealand Information Security Manual (NZISM)

99 controls
Controls in the Chapter 10: Infrastructure – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 99 controls
CodeTitle
new-zealand-information-security-manual-nzism::10.1.42.C.0110.1.42.C.01 Fibre optic backbone at CONFIDENTIAL and above
new-zealand-information-security-manual-nzism::10.1.42.C.0210.1.42.C.02 Fibre optic cable preferred for backbone infrastructure
new-zealand-information-security-manual-nzism::10.1.43.C.0110.1.43.C.01 Use fibre optic cabling generally
new-zealand-information-security-manual-nzism::10.1.43.C.0210.1.43.C.02 Consult GCSB on fibre with conductive strengtheners
new-zealand-information-security-manual-nzism::10.1.43.C.0310.1.43.C.03 Consult GCSB when copper cables are specified
new-zealand-information-security-manual-nzism::10.1.43.C.0410.1.43.C.04 Avoid fibre with conductive metal strengtheners or sheaths
new-zealand-information-security-manual-nzism::10.1.44.C.0110.1.44.C.01 Cabling installed to New Zealand standards
new-zealand-information-security-manual-nzism::10.1.45.C.0110.1.45.C.01 Cable and conduit colours by classification
new-zealand-information-security-manual-nzism::10.1.45.C.0210.1.45.C.02 Label and document additional colour-coded networks
new-zealand-information-security-manual-nzism::10.1.46.C.0110.1.46.C.01 Agree foreign system cable colour at TOP SECRET
new-zealand-information-security-manual-nzism::10.1.46.C.0210.1.46.C.02 Foreign system cable colours distinct at TOP SECRET
new-zealand-information-security-manual-nzism::10.1.46.C.0310.1.46.C.03 Agree foreign system cable colour with stakeholders
new-zealand-information-security-manual-nzism::10.1.46.C.0410.1.46.C.04 Avoid shared colours for foreign and New Zealand cables
new-zealand-information-security-manual-nzism::10.1.47.C.0110.1.47.C.01 Seek GCSB advice on combining special network cabling
new-zealand-information-security-manual-nzism::10.1.47.C.0210.1.47.C.02 Only approved fibre groupings in shared conduits
new-zealand-information-security-manual-nzism::10.1.48.C.0110.1.48.C.01 Fibres within one cable sheath carry one classification
new-zealand-information-security-manual-nzism::10.1.48.C.0210.1.48.C.02 Each fibre cable subunit carries one classification
new-zealand-information-security-manual-nzism::10.1.48.C.0310.1.48.C.03 No mixing of RESTRICTED and CONFIDENTIAL-plus in a cable
new-zealand-information-security-manual-nzism::10.1.49.C.0110.1.49.C.01 Follow GCSB directions for cabling audio secure areas
new-zealand-information-security-manual-nzism::10.1.50.C.0110.1.50.C.01 Different connectors per classification at shared outlets
new-zealand-information-security-manual-nzism::10.1.50.C.0210.1.50.C.02 Distinct TOP SECRET connectors in mixed outlet areas
new-zealand-information-security-manual-nzism::10.1.50.C.0310.1.50.C.03 Label outlets with classification and connector type
new-zealand-information-security-manual-nzism::10.1.50.C.0410.1.50.C.04 Outlet labels show classification and connector type
new-zealand-information-security-manual-nzism::10.1.51.C.0110.1.51.C.01 Power filters for filtered supply (cable fundamentals)
new-zealand-information-security-manual-nzism::10.2.10.C.0110.2.10.C.01 Power filters in non-shared government facilities
new-zealand-information-security-manual-nzism::10.2.6.C.0110.2.6.C.01 TOP SECRET cabling inspectable every five metres
new-zealand-information-security-manual-nzism::10.2.6.C.0210.2.6.C.02 Cabling inspectable at five-metre intervals
new-zealand-information-security-manual-nzism::10.2.7.C.0110.2.7.C.01 Partition or gap between cable groups in shared reticulation
new-zealand-information-security-manual-nzism::10.2.8.C.0110.2.8.C.01 Flexible or plastic conduit from trays to outlets
new-zealand-information-security-manual-nzism::10.2.9.C.0110.2.9.C.01 Inspectable gap between TOP SECRET and lower cabinets
new-zealand-information-security-manual-nzism::10.3.10.C.0110.3.10.C.01 Conduit and sealant at TOP SECRET wall penetrations
new-zealand-information-security-manual-nzism::10.3.11.C.0110.3.11.C.01 Dedicated power board and UPS for TOP SECRET facility
new-zealand-information-security-manual-nzism::10.3.12.C.0110.3.12.C.01 Power filters in shared government facilities
new-zealand-information-security-manual-nzism::10.3.13.C.0110.3.13.C.01 Visible gap separating TOP SECRET cabinets, shared facilities
new-zealand-information-security-manual-nzism::10.3.5.C.0110.3.5.C.01 Fibre optic cabling in shared government facilities
new-zealand-information-security-manual-nzism::10.3.6.C.0110.3.6.C.01 TOP SECRET cables fully inspectable in shared facilities
new-zealand-information-security-manual-nzism::10.3.6.C.0210.3.6.C.02 Five-metre inspection intervals in shared government facilities
new-zealand-information-security-manual-nzism::10.3.7.C.0110.3.7.C.01 Separate cable groups before sharing reticulation
new-zealand-information-security-manual-nzism::10.3.8.C.0110.3.8.C.01 Clear plastic covers for TOP SECRET conduits and trays
new-zealand-information-security-manual-nzism::10.3.9.C.0110.3.9.C.01 Flexible or plastic conduit to wall outlets, shared facilities
new-zealand-information-security-manual-nzism::10.4.10.C.0110.4.10.C.01 Seal conduit at penetrations into lower classified areas
new-zealand-information-security-manual-nzism::10.4.11.C.0110.4.11.C.01 Power board inside secure area with UPS to equipment
new-zealand-information-security-manual-nzism::10.4.12.C.0110.4.12.C.01 Mandatory power filters in shared non-government facilities
new-zealand-information-security-manual-nzism::10.4.13.C.0110.4.13.C.01 Gap or isolator between cabinets of different classification
new-zealand-information-security-manual-nzism::10.4.13.C.0210.4.13.C.02 Inspectable gap or isolator between classified cabinets
new-zealand-information-security-manual-nzism::10.4.4.C.0110.4.4.C.01 Fibre optic cabling mandatory in TOP SECRET areas
new-zealand-information-security-manual-nzism::10.4.4.C.0210.4.4.C.02 Fibre optic cabling in shared non-government facilities
new-zealand-information-security-manual-nzism::10.4.5.C.0110.4.5.C.01 Full-length inspection of TOP SECRET cables, non-government
new-zealand-information-security-manual-nzism::10.4.5.C.0210.4.5.C.02 Five-metre inspection intervals, shared non-government facilities
new-zealand-information-security-manual-nzism::10.4.6.C.0110.4.6.C.01 Partition or gap for TOP SECRET shared reticulation
new-zealand-information-security-manual-nzism::10.4.6.C.0210.4.6.C.02 TOP SECRET cabling in non-shared enclosed reticulation
new-zealand-information-security-manual-nzism::10.4.6.C.0310.4.6.C.03 Separation for cable groups in shared non-government reticulation
new-zealand-information-security-manual-nzism::10.4.7.C.0110.4.7.C.01 Clear or sealed covers on TOP SECRET conduits
new-zealand-information-security-manual-nzism::10.4.7.C.0210.4.7.C.02 Clear or sealed covers on conduits and trays
new-zealand-information-security-manual-nzism::10.4.8.C.0110.4.8.C.01 No cabling in party walls
new-zealand-information-security-manual-nzism::10.4.9.C.0110.4.9.C.01 GCSB endorsed tamper evident seals on removable covers
new-zealand-information-security-manual-nzism::10.4.9.C.0210.4.9.C.02 Uniquely numbered seals with location register
new-zealand-information-security-manual-nzism::10.4.9.C.0310.4.9.C.03 Glue or sealant on TOP SECRET conduit joints
new-zealand-information-security-manual-nzism::10.4.9.C.0410.4.9.C.04 Seal conduit joints with glue or sealant
new-zealand-information-security-manual-nzism::10.5.10.C.0110.5.10.C.01 Minimum cable register fields at CONFIDENTIAL and above
new-zealand-information-security-manual-nzism::10.5.10.C.0210.5.10.C.02 Minimum cable register content
new-zealand-information-security-manual-nzism::10.5.11.C.0110.5.11.C.01 Inspect cables against register at SSP frequency
new-zealand-information-security-manual-nzism::10.5.4.C.0110.5.4.C.01 Conduit label colours by classification
new-zealand-information-security-manual-nzism::10.5.5.C.0110.5.5.C.01 Discreet conduit labels in public or visitor areas
new-zealand-information-security-manual-nzism::10.5.6.C.0110.5.6.C.01 Wall outlet boxes show classification and numbers
new-zealand-information-security-manual-nzism::10.5.6.C.0210.5.6.C.02 Outlet boxes marked with classification, cable, outlet numbers
new-zealand-information-security-manual-nzism::10.5.7.C.0110.5.7.C.01 SOPs record labelling and registration conventions
new-zealand-information-security-manual-nzism::10.5.8.C.0110.5.8.C.01 Label both cable ends for identification at CONFIDENTIAL-plus
new-zealand-information-security-manual-nzism::10.5.8.C.0210.5.8.C.02 Label cable ends for identification and inspection
new-zealand-information-security-manual-nzism::10.5.9.C.0110.5.9.C.01 Maintain a cable register at CONFIDENTIAL and above
new-zealand-information-security-manual-nzism::10.5.9.C.0210.5.9.C.02 Keep a register of cables
new-zealand-information-security-manual-nzism::10.6.22.C.0110.6.22.C.01 Only approved cable groups terminate on a patch panel
new-zealand-information-security-manual-nzism::10.6.22.C.0210.6.22.C.02 Separate and bundle RED and BLACK cables
new-zealand-information-security-manual-nzism::10.6.23.C.0110.6.23.C.01 Distinct connectors per classification in multi-classification areas
new-zealand-information-security-manual-nzism::10.6.23.C.0210.6.23.C.02 Document connector type choice per classification
new-zealand-information-security-manual-nzism::10.6.23.C.0310.6.23.C.03 Different connectors for each system in mixed areas
new-zealand-information-security-manual-nzism::10.6.23.C.0410.6.23.C.04 Document connector types in mixed classification areas
new-zealand-information-security-manual-nzism::10.6.24.C.0110.6.24.C.01 Separate cabinets for patch panels of different classification
new-zealand-information-security-manual-nzism::10.6.24.C.0210.6.24.C.02 Conditions for mixed classification patch panels in one cabinet
new-zealand-information-security-manual-nzism::10.6.25.C.0110.6.25.C.01 Cabinet layout RED top, BLACK centre, power bottom
new-zealand-information-security-manual-nzism::10.6.26.C.0110.6.26.C.01 Record equipment layouts on rack diagrams
new-zealand-information-security-manual-nzism::10.6.27.C.0110.6.27.C.01 Fibre fly lead length and long-lead conditions
new-zealand-information-security-manual-nzism::10.6.28.C.0110.6.28.C.01 Equipotential bonding of all earthing points
new-zealand-information-security-manual-nzism::10.6.28.C.0210.6.28.C.02 Earth bond all conductive cabinet and rack elements
new-zealand-information-security-manual-nzism::10.6.29.C.0110.6.29.C.01 Cabinet rail installation for cable management
new-zealand-information-security-manual-nzism::10.6.30.C.0110.6.30.C.01 Apply cable labelling principles and specific requirements
new-zealand-information-security-manual-nzism::10.6.31.C.0110.6.31.C.01 Follow good practice for power cable installation
new-zealand-information-security-manual-nzism::10.7.6.C.0110.7.6.C.01 Emanation threat assessment for co-located RF transmitters
new-zealand-information-security-manual-nzism::10.7.6.C.0210.7.6.C.02 RF transmitters co-located with CONFIDENTIAL-plus systems
new-zealand-information-security-manual-nzism::10.7.7.C.0110.7.7.C.01 Emanation threat assessment for overseas classified deployments
new-zealand-information-security-manual-nzism::10.7.7.C.0210.7.7.C.02 Emanation advice for overseas system deployments
new-zealand-information-security-manual-nzism::10.7.8.C.0110.7.8.C.01 Early emanation security threat assessment in projects
new-zealand-information-security-manual-nzism::10.7.9.C.0110.7.9.C.01 EMI/EMC standards for equipment in secure areas
new-zealand-information-security-manual-nzism::10.8.34.C.0110.8.34.C.01 Documented risk assessment before network architecture design
new-zealand-information-security-manual-nzism::10.8.34.C.0210.8.34.C.02 Separation, segregation and classification in network risk assessment
new-zealand-information-security-manual-nzism::10.8.35.C.0110.8.35.C.01 Security architecture applies separation and segregation
new-zealand-information-security-manual-nzism::10.8.36.C.0110.8.36.C.01 Identify classification and restrictions per network part
new-zealand-information-security-manual-nzism::10.8.37.C.0110.8.37.C.01 Visually distinguish systems of different classifications
new-zealand-information-security-manual-nzism::10.8.38.C.0110.8.38.C.01 Maintain a network information repository

Chapter 11: Communications Systems and Devices – New Zealand Information Security Manual (NZISM)

114 controls
Controls in the Chapter 11: Communications Systems and Devices – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 114 controls
CodeTitle
new-zealand-information-security-manual-nzism::11.1.15.C.0111.1.15.C.01 Bluetooth usage policy defining permitted and prohibited use
new-zealand-information-security-manual-nzism::11.1.15.C.0211.1.15.C.02 Bluetooth policy specifies security controls and verification methods
new-zealand-information-security-manual-nzism::11.1.16.C.0111.1.16.C.01 Bluetooth pairing restricted to authorised devices
new-zealand-information-security-manual-nzism::11.1.16.C.0211.1.16.C.02 Bluetooth discoverability disabled except during pairing
new-zealand-information-security-manual-nzism::11.1.16.C.0311.1.16.C.03 Bluetooth pairing performed only in access-controlled locations
new-zealand-information-security-manual-nzism::11.1.16.C.0411.1.16.C.04 Removal of Bluetooth pairings no longer needed
new-zealand-information-security-manual-nzism::11.1.17.C.0111.1.17.C.01 Most secure Bluetooth configuration supported by paired devices
new-zealand-information-security-manual-nzism::11.1.17.C.0211.1.17.C.02 Identify Bluetooth type, version and security capabilities for risk decisions
new-zealand-information-security-manual-nzism::11.1.17.C.0311.1.17.C.03 Explicit user authentication of new Bluetooth connections
new-zealand-information-security-manual-nzism::11.1.18.C.0111.1.18.C.01 Bluetooth authentication and approved algorithms for UNCLASSIFIED and IN-CONFIDENCE
new-zealand-information-security-manual-nzism::11.1.18.C.0211.1.18.C.02 Bluetooth authentication and approved algorithms for RESTRICTED and SENSITIVE
new-zealand-information-security-manual-nzism::11.1.18.C.0311.1.18.C.03 Risk assessment and waiver when Bluetooth cannot meet approved encryption
new-zealand-information-security-manual-nzism::11.1.19.C.0111.1.19.C.01 Technical evaluation and Accreditation Authority approval for Bluetooth in secure areas
new-zealand-information-security-manual-nzism::11.1.19.C.0211.1.19.C.02 Bluetooth emanation and classification separation in secure areas
new-zealand-information-security-manual-nzism::11.1.19.C.0311.1.19.C.03 Bluetooth devices barred from secure areas without authorisation
new-zealand-information-security-manual-nzism::11.2.11.C.0111.2.11.C.01 RF devices kept out of classified secure areas
new-zealand-information-security-manual-nzism::11.2.11.C.0211.2.11.C.02 RF devices in secure areas only with Accreditation Authority authorisation
new-zealand-information-security-manual-nzism::11.2.12.C.0111.2.12.C.01 Limiting RF range beyond the agency's area of control
new-zealand-information-security-manual-nzism::11.2.13.C.0111.2.13.C.01 Detection of and response to active RF devices in secure areas
new-zealand-information-security-manual-nzism::11.2.14.C.0111.2.14.C.01 Wireless RF and IR pointing devices prohibited in secure areas
new-zealand-information-security-manual-nzism::11.2.15.C.0111.2.15.C.01 Infrared keyboard restrictions for SECRET and CONFIDENTIAL areas
new-zealand-information-security-manual-nzism::11.2.15.C.0211.2.15.C.02 Infrared keyboard restrictions for TOP SECRET areas
new-zealand-information-security-manual-nzism::11.2.15.C.0311.2.15.C.03 IR receiver positioned away from secure area boundary
new-zealand-information-security-manual-nzism::11.3.10.C.0111.3.10.C.01 Cordless telephones not combined with secure telephony devices
new-zealand-information-security-manual-nzism::11.3.11.C.0111.3.11.C.01 Speakerphone controls on secure telephone systems in secure areas
new-zealand-information-security-manual-nzism::11.3.12.C.0111.3.12.C.01 Off-hook audio protection on non-accredited telephones in classified areas
new-zealand-information-security-manual-nzism::11.3.12.C.0211.3.12.C.02 Push-to-talk for off-hook audio protection with clear labelling
new-zealand-information-security-manual-nzism::11.3.12.C.0311.3.12.C.03 Off-hook audio protection recommended at all classifications
new-zealand-information-security-manual-nzism::11.3.13.C.0111.3.13.C.01 Removal of unused voice mailboxes
new-zealand-information-security-manual-nzism::11.3.13.C.0211.3.13.C.02 Voicemail expiry per electronic records retention policy
new-zealand-information-security-manual-nzism::11.3.13.C.0311.3.13.C.03 Retention and disposal policy for voicemail, email and electronic records
new-zealand-information-security-manual-nzism::11.3.5.C.0111.3.5.C.01 Policy governing telephone and telephone system use
new-zealand-information-security-manual-nzism::11.3.6.C.0111.3.6.C.01 Personnel told maximum classification for telephone conversations
new-zealand-information-security-manual-nzism::11.3.6.C.0211.3.6.C.02 Awareness of audio security risk from telephones
new-zealand-information-security-manual-nzism::11.3.7.C.0111.3.7.C.01 Telephones showing the classification of the connection
new-zealand-information-security-manual-nzism::11.3.8.C.0111.3.8.C.01 Accredited and encrypted telephone systems for classified traffic
new-zealand-information-security-manual-nzism::11.3.9.C.0111.3.9.C.01 Cordless telephones prohibited for classified conversations
new-zealand-information-security-manual-nzism::11.3.9.C.0211.3.9.C.02 Avoid cordless telephones for classified or sensitive calls
new-zealand-information-security-manual-nzism::11.4.10.C.0111.4.10.C.01 Personnel told maximum classification for mobile device conversations
new-zealand-information-security-manual-nzism::11.4.10.C.0211.4.10.C.02 Awareness of known mobile device risks near classified conversations
new-zealand-information-security-manual-nzism::11.4.11.C.0111.4.11.C.01 Certified networks, encryption and user awareness for classified mobile use
new-zealand-information-security-manual-nzism::11.4.12.C.0111.4.12.C.01 Mobile devices excluded from classified secure areas
new-zealand-information-security-manual-nzism::11.4.12.C.0211.4.12.C.02 Lockers for mobile devices outside secure areas
new-zealand-information-security-manual-nzism::11.4.9.C.0111.4.9.C.01 Mobile device usage policy
new-zealand-information-security-manual-nzism::11.5.13.C.0111.5.13.C.01 Personal wearable device usage policy including fitness devices
new-zealand-information-security-manual-nzism::11.5.14.C.0111.5.14.C.01 Personnel told maximum classification where wearables are present
new-zealand-information-security-manual-nzism::11.5.14.C.0211.5.14.C.02 Awareness of wearable device risks in secure and classified areas
new-zealand-information-security-manual-nzism::11.5.15.C.0111.5.15.C.01 Personal wearable devices excluded from secure areas
new-zealand-information-security-manual-nzism::11.5.15.C.0211.5.15.C.02 Lockers for wearable devices outside secure areas
new-zealand-information-security-manual-nzism::11.5.16.C.0111.5.16.C.01 Prohibited capabilities on medically approved wearables
new-zealand-information-security-manual-nzism::11.5.16.C.0211.5.16.C.02 Accredited networks and user awareness for medically exempt wearables
new-zealand-information-security-manual-nzism::11.5.16.C.0311.5.16.C.03 Privacy legislation compliance for medically permitted wearables
new-zealand-information-security-manual-nzism::11.6.59.C.0111.6.59.C.01 Documented risk assessment before adopting RFID
new-zealand-information-security-manual-nzism::11.6.59.C.0211.6.59.C.02 RFID risk assessment underpins security architecture
new-zealand-information-security-manual-nzism::11.6.60.C.0111.6.60.C.01 Security architecture protecting RFID databases and systems
new-zealand-information-security-manual-nzism::11.6.60.C.0211.6.60.C.02 Minimise data on RFID tags and subsystems
new-zealand-information-security-manual-nzism::11.6.60.C.0311.6.60.C.03 Disable rewrite functions on RFID devices
new-zealand-information-security-manual-nzism::11.6.60.C.0411.6.60.C.04 NZISM Chapter 11 access control requirements applied to RFID
new-zealand-information-security-manual-nzism::11.6.61.C.0111.6.61.C.01 RFID usage policy developed and maintained
new-zealand-information-security-manual-nzism::11.6.61.C.0211.6.61.C.02 RFID included in security policies and documentation
new-zealand-information-security-manual-nzism::11.6.62.C.0111.6.62.C.01 Inspect and neutralise RFID devices on incoming items
new-zealand-information-security-manual-nzism::11.6.62.C.0211.6.62.C.02 Visual inspection for attached RFID devices of concern
new-zealand-information-security-manual-nzism::11.6.62.C.0311.6.62.C.03 Visual inspection for tampered RFID devices or labels
new-zealand-information-security-manual-nzism::11.6.63.C.0111.6.63.C.01 RF engineering assessment for RFID in high RF or concern areas
new-zealand-information-security-manual-nzism::11.6.63.C.0211.6.63.C.02 Shielding for RFID eavesdropping or radiation concerns
new-zealand-information-security-manual-nzism::11.6.64.C.0111.6.64.C.01 RFID tag and reader placement to limit radiation
new-zealand-information-security-manual-nzism::11.6.65.C.0111.6.65.C.01 RFID cryptography per NZISM Chapter 17
new-zealand-information-security-manual-nzism::11.6.65.C.0211.6.65.C.02 Encrypt data before writing to RFID tags
new-zealand-information-security-manual-nzism::11.6.65.C.0311.6.65.C.03 RFID identifier formats that limit disclosure
new-zealand-information-security-manual-nzism::11.6.66.C.0111.6.66.C.01 HMAC for RFID tag authenticity
new-zealand-information-security-manual-nzism::11.6.67.C.0111.6.67.C.01 Passwords set for critical RFID functions
new-zealand-information-security-manual-nzism::11.6.67.C.0211.6.67.C.02 RFID password management per NZISM Chapter 16
new-zealand-information-security-manual-nzism::11.6.68.C.0111.6.68.C.01 Temporary deactivation of long-inactive RFID tags
new-zealand-information-security-manual-nzism::11.6.69.C.0111.6.69.C.01 RFID incident identification and management processes
new-zealand-information-security-manual-nzism::11.6.70.C.0111.6.70.C.01 Secure disposal procedures in RFID usage policy
new-zealand-information-security-manual-nzism::11.6.71.C.0111.6.71.C.01 RFID user awareness and training programme
new-zealand-information-security-manual-nzism::11.6.72.C.0111.6.72.C.01 Class 3, 4 and 5 RFID tags banned from secure spaces
new-zealand-information-security-manual-nzism::11.6.72.C.0211.6.72.C.02 RFID readers banned from secure spaces
new-zealand-information-security-manual-nzism::11.6.72.C.0311.6.72.C.03 Class 2 RFID tags kept out of secure spaces
new-zealand-information-security-manual-nzism::11.7.29.C.0111.7.29.C.01 Documented risk assessment before adopting RFID access cards
new-zealand-information-security-manual-nzism::11.7.29.C.0211.7.29.C.02 Access card risk assessment underpins security architecture
new-zealand-information-security-manual-nzism::11.7.30.C.0111.7.30.C.01 Security architecture protecting access card databases and systems
new-zealand-information-security-manual-nzism::11.7.30.C.0211.7.30.C.02 NZISM access and cryptographic controls on access card systems
new-zealand-information-security-manual-nzism::11.7.30.C.0311.7.30.C.03 Network design elements for isolating access card systems
new-zealand-information-security-manual-nzism::11.7.31.C.0111.7.31.C.01 Access card usage policy developed and maintained
new-zealand-information-security-manual-nzism::11.7.31.C.0211.7.31.C.02 Access cards included in security policies and documentation
new-zealand-information-security-manual-nzism::11.7.32.C.0111.7.32.C.01 Tamper-resistant access card systems selected
new-zealand-information-security-manual-nzism::11.7.32.C.0211.7.32.C.02 Controls reducing access card tampering risk
new-zealand-information-security-manual-nzism::11.7.32.C.0311.7.32.C.03 Access card tag and reader placement to limit radiation
new-zealand-information-security-manual-nzism::11.7.32.C.0411.7.32.C.04 Additional physical controls chosen per the PSR
new-zealand-information-security-manual-nzism::11.7.33.C.0111.7.33.C.01 Access card cryptography per NZISM Chapter 17
new-zealand-information-security-manual-nzism::11.7.33.C.0211.7.33.C.02 Encrypt data before writing to access cards
new-zealand-information-security-manual-nzism::11.7.33.C.0311.7.33.C.03 Secure Access Modules in card systems
new-zealand-information-security-manual-nzism::11.7.34.C.0111.7.34.C.01 Access card incident identification and management processes
new-zealand-information-security-manual-nzism::11.7.35.C.0111.7.35.C.01 Secure disposal procedures in access card usage policy
new-zealand-information-security-manual-nzism::11.8.10.C.0111.8.10.C.01 Supervised or cleared maintenance of MFDs in classified areas
new-zealand-information-security-manual-nzism::11.8.10.C.0211.8.10.C.02 Disposal of removed storage, drums and chipped cartridges per Chapter 13
new-zealand-information-security-manual-nzism::11.8.10.C.0311.8.10.C.03 Toner cartridge memory chips removed and disposed per Chapter 13
new-zealand-information-security-manual-nzism::11.8.10.C.0411.8.10.C.04 Supervised or cleared MFD maintenance at all classifications
new-zealand-information-security-manual-nzism::11.8.10.C.0511.8.10.C.05 Recommended Chapter 13 disposal of removed MFD components
new-zealand-information-security-manual-nzism::11.8.11.C.0111.8.11.C.01 Supervised or cleared use of MFD USB capability
new-zealand-information-security-manual-nzism::11.8.11.C.0211.8.11.C.02 Recommended supervision of MFD USB use at all classifications
new-zealand-information-security-manual-nzism::11.8.12.C.0111.8.12.C.01 Decommissioning MFD components holding data per Chapter 13
new-zealand-information-security-manual-nzism::11.8.12.C.0211.8.12.C.02 Recommended Chapter 13 disposal of data-bearing MFD components
new-zealand-information-security-manual-nzism::11.8.13.C.0111.8.13.C.01 Central logging of MFD printing, scanning and copying
new-zealand-information-security-manual-nzism::11.8.3.C.0111.8.3.C.01 Policy for MFDs, network printers and fax machines
new-zealand-information-security-manual-nzism::11.8.4.C.0111.8.4.C.01 Encryption of classified fax messages over unsecured networks
new-zealand-information-security-manual-nzism::11.8.4.C.0211.8.4.C.02 Separate devices for classified and RESTRICTED-or-lower fax traffic
new-zealand-information-security-manual-nzism::11.8.5.C.0111.8.5.C.01 Sender arrangements for fax collection and non-arrival notice
new-zealand-information-security-manual-nzism::11.8.6.C.0111.8.6.C.01 No direct MFD to telephone network connection below network classification
new-zealand-information-security-manual-nzism::11.8.6.C.0211.8.6.C.02 Avoid direct MFD telephone connections at all classifications
new-zealand-information-security-manual-nzism::11.8.7.C.0111.8.7.C.01 Identification, authentication, audit and gateway filtering for networked MFDs
new-zealand-information-security-manual-nzism::11.8.8.C.0111.8.8.C.01 Networked MFDs not used for documents above network classification
new-zealand-information-security-manual-nzism::11.8.9.C.0111.8.9.C.01 MFDs and fax machines placed where use is observable

Chapter 12: Product Security – New Zealand Information Security Manual (NZISM)

74 controls
Controls in the Chapter 12: Product Security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 74 controls
CodeTitle
new-zealand-information-security-manual-nzism::12.1.30.C.0112.1.30.C.01 Mandatory preference order for evaluated products
new-zealand-information-security-manual-nzism::12.1.30.C.0212.1.30.C.02 Justify and accept risk for in-evaluation products
new-zealand-information-security-manual-nzism::12.1.30.C.0312.1.30.C.03 Preferred ranking when selecting evaluated products
new-zealand-information-security-manual-nzism::12.1.31.C.0112.1.31.C.01 Evaluated scope must cover required security functions
new-zealand-information-security-manual-nzism::12.1.32.C.0112.1.32.C.01 Check consumer guides for product requirements
new-zealand-information-security-manual-nzism::12.1.32.C.0212.1.32.C.02 Comply with consumer guide product requirements
new-zealand-information-security-manual-nzism::12.1.32.C.0312.1.32.C.03 Consult GCSB before buying high assurance products
new-zealand-information-security-manual-nzism::12.1.33.C.0112.1.33.C.01 Verify integrity and test non-evaluated software
new-zealand-information-security-manual-nzism::12.1.34.C.0112.1.34.C.01 Follow GCSB delivery procedures for high assurance products
new-zealand-information-security-manual-nzism::12.1.34.C.0212.1.34.C.02 Deliver products per documented delivery procedures
new-zealand-information-security-manual-nzism::12.1.35.C.0112.1.35.C.01 Check non-evaluated deliveries for tampering
new-zealand-information-security-manual-nzism::12.1.36.C.0112.1.36.C.01 Leasing agreements address maintenance and sanitisation
new-zealand-information-security-manual-nzism::12.1.37.C.0112.1.37.C.01 Prefer developers committed to ongoing assurance
new-zealand-information-security-manual-nzism::12.2.5.C.0112.2.5.C.01 Operate high assurance products per product policy
new-zealand-information-security-manual-nzism::12.2.5.C.0212.2.5.C.02 Configure evaluated products per evaluation documentation
new-zealand-information-security-manual-nzism::12.2.6.C.0112.2.6.C.01 Risk assess unevaluated product configurations
new-zealand-information-security-manual-nzism::12.2.6.C.0212.2.6.C.02 No unevaluated configurations for high assurance products
new-zealand-information-security-manual-nzism::12.3.4.C.0112.3.4.C.01 Classify IT equipment by highest approved information
new-zealand-information-security-manual-nzism::12.3.5.C.0112.3.5.C.01 Label classified-capable equipment with protective markings
new-zealand-information-security-manual-nzism::12.3.5.C.0212.3.5.C.02 Label data centre equipment with asset and classification
new-zealand-information-security-manual-nzism::12.3.6.C.0112.3.6.C.01 No non-essential labels on high assurance products
new-zealand-information-security-manual-nzism::12.3.7.C.0112.3.7.C.01 Get GCSB authorisation before labelling HACE
new-zealand-information-security-manual-nzism::12.4.3.C.0112.4.3.C.01 Monitor sources for vulnerabilities and patches
new-zealand-information-security-manual-nzism::12.4.4.C.0112.4.4.C.01 Apply critical patches within two days
new-zealand-information-security-manual-nzism::12.4.4.C.0212.4.4.C.02 Maintain a patch management strategy with testing
new-zealand-information-security-manual-nzism::12.4.4.C.0312.4.4.C.03 No patching high assurance products without GCSB approval
new-zealand-information-security-manual-nzism::12.4.4.C.0412.4.4.C.04 Apply critical patches preferably within two days
new-zealand-information-security-manual-nzism::12.4.4.C.0512.4.4.C.05 Apply non-critical patches promptly
new-zealand-information-security-manual-nzism::12.4.4.C.0612.4.4.C.06 Use vendor recommended patch processes
new-zealand-information-security-manual-nzism::12.4.5.C.0112.4.5.C.01 Compensating controls where patches are unavailable
new-zealand-information-security-manual-nzism::12.4.6.C.0112.4.6.C.01 Verify integrity and authenticity of firmware updates
new-zealand-information-security-manual-nzism::12.4.7.C.0112.4.7.C.01 Assess risk of unsupported products
new-zealand-information-security-manual-nzism::12.5.3.C.0112.5.3.C.01 GCSB approval before repairing high assurance products
new-zealand-information-security-manual-nzism::12.5.3.C.0212.5.3.C.02 On-site repair by cleared technicians
new-zealand-information-security-manual-nzism::12.5.4.C.0112.5.4.C.01 Escort requirements for uncleared technicians
new-zealand-information-security-manual-nzism::12.5.4.C.0212.5.4.C.02 Sanitise equipment before uncleared technician work
new-zealand-information-security-manual-nzism::12.5.4.C.0312.5.4.C.03 Adequate escort to technician ratio
new-zealand-information-security-manual-nzism::12.5.4.C.0412.5.4.C.04 Escort familiar with the product being repaired
new-zealand-information-security-manual-nzism::12.5.5.C.0112.5.5.C.01 Protect equipment during off-site repair
new-zealand-information-security-manual-nzism::12.5.6.C.0112.5.6.C.01 Off-site repairs follow destination area classification
new-zealand-information-security-manual-nzism::12.5.6.C.0212.5.6.C.02 Inspect equipment returned to secure areas
new-zealand-information-security-manual-nzism::12.6.10.C.0112.6.10.C.01 Redeploy or dispose of monitors per NZISM guidance
new-zealand-information-security-manual-nzism::12.6.4.C.0112.6.4.C.01 Sanitise or destroy equipment before disposal
new-zealand-information-security-manual-nzism::12.6.4.C.0212.6.4.C.02 Return unsanitisable NZEO equipment to New Zealand
new-zealand-information-security-manual-nzism::12.6.5.C.0112.6.5.C.01 Documented IT equipment disposal process
new-zealand-information-security-manual-nzism::12.6.5.C.0212.6.5.C.02 GCSB requirements for high assurance product disposal
new-zealand-information-security-manual-nzism::12.6.5.C.0312.6.5.C.03 GCSB requirements for HACE disposal
new-zealand-information-security-manual-nzism::12.6.5.C.0412.6.5.C.04 GCSB requirements for TEMPEST or non-functional equipment disposal
new-zealand-information-security-manual-nzism::12.6.5.C.0512.6.5.C.05 Sanitise and authorise disposal to public domain
new-zealand-information-security-manual-nzism::12.6.6.C.0112.6.6.C.01 Print three random-text pages to sanitise drums
new-zealand-information-security-manual-nzism::12.6.6.C.0212.6.6.C.02 Sanitise printer and copier drums before disposal
new-zealand-information-security-manual-nzism::12.6.7.C.0112.6.7.C.01 Destroy drums that cannot be sanitised
new-zealand-information-security-manual-nzism::12.6.7.C.0212.6.7.C.02 Destroy unsanitisable printer cartridges and drums
new-zealand-information-security-manual-nzism::12.6.8.C.0112.6.8.C.01 Inspect screens for burn-in before disposal
new-zealand-information-security-manual-nzism::12.6.9.C.0112.6.9.C.01 Sanitise or destroy screens with burn-in
new-zealand-information-security-manual-nzism::12.7.14.C.0112.7.14.C.01 Include supply chain risk in enterprise risk management
new-zealand-information-security-manual-nzism::12.7.14.C.0212.7.14.C.02 Continuously monitor supply chain risks
new-zealand-information-security-manual-nzism::12.7.14.C.0312.7.14.C.03 Follow the Government Rules of Procurement
new-zealand-information-security-manual-nzism::12.7.15.C.0112.7.15.C.01 Tenderers disclose export restrictions and supply chain compliance
new-zealand-information-security-manual-nzism::12.7.15.C.0212.7.15.C.02 Assess contractor ability to protect information
new-zealand-information-security-manual-nzism::12.7.16.C.0112.7.16.C.01 Contractual safeguarding obligations for all contractors
new-zealand-information-security-manual-nzism::12.7.16.C.0212.7.16.C.02 Include information safeguarding in contracts
new-zealand-information-security-manual-nzism::12.7.16.C.0312.7.16.C.03 Reject unreliable or previously breaching contractors
new-zealand-information-security-manual-nzism::12.7.17.C.0112.7.17.C.01 Supply chain changes preserve continuity of supply
new-zealand-information-security-manual-nzism::12.7.18.C.0112.7.18.C.01 Suppliers must provide product provenance
new-zealand-information-security-manual-nzism::12.7.18.C.0212.7.18.C.02 Request provenance of products and equipment
new-zealand-information-security-manual-nzism::12.7.19.C.0112.7.19.C.01 Validate equipment security against requirements
new-zealand-information-security-manual-nzism::12.7.19.C.0212.7.19.C.02 Mitigate identified security deficiencies
new-zealand-information-security-manual-nzism::12.7.20.C.0112.7.20.C.01 Consult GCSB on pre-installation security testing
new-zealand-information-security-manual-nzism::12.7.20.C.0212.7.20.C.02 Inspect equipment on receipt for tampering
new-zealand-information-security-manual-nzism::12.7.20.C.0312.7.20.C.03 Inspect and test operation before installation
new-zealand-information-security-manual-nzism::12.7.20.C.0412.7.20.C.04 Verify installation before operational use
new-zealand-information-security-manual-nzism::12.7.20.C.0512.7.20.C.05 Malware check code needed by equipment
new-zealand-information-security-manual-nzism::12.7.21.C.0112.7.21.C.01 Secure long-term servicing for critical equipment

Chapter 13: Media and IT Equipment Management, Decommissioning and Disposal – New Zealand Information Security Manual (NZISM)

89 controls
Controls in the Chapter 13: Media and IT Equipment Management, Decommissioning and Disposal – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 89 controls
CodeTitle
new-zealand-information-security-manual-nzism::13.1.10.C.0113.1.10.C.01 Proportionate risk assessment before migration or decommissioning
new-zealand-information-security-manual-nzism::13.1.10.C.0213.1.10.C.02 Required elements of the migration risk assessment
new-zealand-information-security-manual-nzism::13.1.10.C.0313.1.10.C.03 Consider a Privacy Impact Assessment for migration
new-zealand-information-security-manual-nzism::13.1.10.C.0413.1.10.C.04 Identify and terminate related service and legal agreements
new-zealand-information-security-manual-nzism::13.1.11.C.0113.1.11.C.01 Contents of the system decommissioning plan
new-zealand-information-security-manual-nzism::13.1.12.C.0113.1.12.C.01 Identify retention policies and laws before archiving
new-zealand-information-security-manual-nzism::13.1.12.C.0213.1.12.C.02 Archive adequate system documentation on decommissioning
new-zealand-information-security-manual-nzism::13.1.12.C.0313.1.12.C.03 Archive software and data needed for recovery
new-zealand-information-security-manual-nzism::13.1.13.C.0113.1.13.C.01 Accreditation Authority confirms IA compliance at decommissioning
new-zealand-information-security-manual-nzism::13.1.13.C.0213.1.13.C.02 Accreditation Authority confirms secure media disposal
new-zealand-information-security-manual-nzism::13.1.13.C.0313.1.13.C.03 Accreditation Authority confirms asset register updates
new-zealand-information-security-manual-nzism::13.1.13.C.0413.1.13.C.04 Issue a Security Decommissioning Compliance Certificate
new-zealand-information-security-manual-nzism::13.1.14.C.0113.1.14.C.01 Conduct a post-decommissioning review
new-zealand-information-security-manual-nzism::13.1.9.C.0113.1.9.C.01 Policy for secure end-of-life system decommissioning
new-zealand-information-security-manual-nzism::13.2.10.C.0113.2.10.C.01 Conditions for reclassifying media downward
new-zealand-information-security-manual-nzism::13.2.11.C.0113.2.11.C.01 Triggers for reclassifying media to a higher level
new-zealand-information-security-manual-nzism::13.2.12.C.0113.2.12.C.01 Label classified media with maximum classification and endorsements
new-zealand-information-security-manual-nzism::13.2.12.C.0213.2.12.C.02 Classified media classification visually identifiable
new-zealand-information-security-manual-nzism::13.2.12.C.0313.2.12.C.03 Document and train on non-textual media marking schemes
new-zealand-information-security-manual-nzism::13.2.12.C.0413.2.12.C.04 Label all media with classification and endorsements
new-zealand-information-security-manual-nzism::13.2.13.C.0113.2.13.C.01 Warning notice on sanitised and reclassified media
new-zealand-information-security-manual-nzism::13.2.14.C.0113.2.14.C.01 Register classified media with unique identifiers
new-zealand-information-security-manual-nzism::13.2.14.C.0213.2.14.C.02 Register all media with unique identifiers
new-zealand-information-security-manual-nzism::13.2.6.C.0113.2.6.C.01 Documented media reclassification and declassification procedures
new-zealand-information-security-manual-nzism::13.2.7.C.0113.2.7.C.01 Classify media at highest stored data classification
new-zealand-information-security-manual-nzism::13.2.8.C.0113.2.8.C.01 Media connected to higher systems takes the higher classification
new-zealand-information-security-manual-nzism::13.2.9.C.0113.2.9.C.01 Conditions for classifying media below its connected system
new-zealand-information-security-manual-nzism::13.3.10.C.0113.3.10.C.01 External-interface media in TOP SECRET areas needs approval
new-zealand-information-security-manual-nzism::13.3.4.C.0113.3.4.C.01 No classified media on lower-classified systems
new-zealand-information-security-manual-nzism::13.3.5.C.0113.3.5.C.01 Media storage meets PSR physical requirements
new-zealand-information-security-manual-nzism::13.3.6.C.0113.3.6.C.01 Disable autorun for connectable devices and media
new-zealand-information-security-manual-nzism::13.3.6.C.0213.3.6.C.02 Block unauthorised media from connecting to systems
new-zealand-information-security-manual-nzism::13.3.6.C.0313.3.6.C.03 Prevent unintended writes to connected writable media
new-zealand-information-security-manual-nzism::13.3.7.C.0113.3.7.C.01 Disable FireWire interfaces on classified systems
new-zealand-information-security-manual-nzism::13.3.7.C.0213.3.7.C.02 Disable FireWire interfaces on all systems
new-zealand-information-security-manual-nzism::13.3.8.C.0113.3.8.C.01 Media transfer processes meet PSR transfer requirements
new-zealand-information-security-manual-nzism::13.3.8.C.0213.3.8.C.02 Encrypt media data before transfer to another location
new-zealand-information-security-manual-nzism::13.3.9.C.0113.3.9.C.01 Log cross-classification data transfers
new-zealand-information-security-manual-nzism::13.3.9.C.0213.3.9.C.02 Avoid rewriteable media for manual cross-domain transfers
new-zealand-information-security-manual-nzism::13.4.10.C.0113.4.10.C.01 Destroy media types that cannot be sanitised
new-zealand-information-security-manual-nzism::13.4.11.C.0113.4.11.C.01 Method for sanitising volatile media
new-zealand-information-security-manual-nzism::13.4.12.C.0113.4.12.C.01 Post-sanitisation classification of volatile media
new-zealand-information-security-manual-nzism::13.4.13.C.0113.4.13.C.01 Overwrite passes for non-volatile magnetic media
new-zealand-information-security-manual-nzism::13.4.13.C.0213.4.13.C.02 Boot from separate media when sanitising
new-zealand-information-security-manual-nzism::13.4.13.C.0313.4.13.C.03 Reset HPA and DCO before overwriting disks
new-zealand-information-security-manual-nzism::13.4.13.C.0413.4.13.C.04 Attempt to overwrite the growth defects table
new-zealand-information-security-manual-nzism::13.4.13.C.0513.4.13.C.05 Prefer ATA Secure Erase over block overwriting
new-zealand-information-security-manual-nzism::13.4.14.C.0113.4.14.C.01 Post-sanitisation classification of magnetic media
new-zealand-information-security-manual-nzism::13.4.15.C.0113.4.15.C.01 Sanitising EPROM media
new-zealand-information-security-manual-nzism::13.4.16.C.0113.4.16.C.01 Sanitising EEPROM media
new-zealand-information-security-manual-nzism::13.4.17.C.0113.4.17.C.01 Post-sanitisation classification of EPROM and EEPROM
new-zealand-information-security-manual-nzism::13.4.18.C.0113.4.18.C.01 Sanitising flash memory media
new-zealand-information-security-manual-nzism::13.4.19.C.0113.4.19.C.01 Post-sanitisation classification of flash memory
new-zealand-information-security-manual-nzism::13.4.19.C.0213.4.19.C.02 Destroy items without known sanitisation procedures
new-zealand-information-security-manual-nzism::13.4.20.C.0113.4.20.C.01 Destroy solid state drives before disposal
new-zealand-information-security-manual-nzism::13.4.20.C.0213.4.20.C.02 ATA Secure Erase SSDs before redeployment
new-zealand-information-security-manual-nzism::13.4.20.C.0313.4.20.C.03 No redeploying classified SSDs to lower environments
new-zealand-information-security-manual-nzism::13.4.21.C.0113.4.21.C.01 Treat hybrid drives as solid state drives
new-zealand-information-security-manual-nzism::13.4.22.C.0113.4.22.C.01 Sanitise before reuse at same or higher classification
new-zealand-information-security-manual-nzism::13.4.23.C.0113.4.23.C.01 Verify sanitisation with a different product
new-zealand-information-security-manual-nzism::13.4.9.C.0113.4.9.C.01 Documented media and IT equipment sanitisation procedures
new-zealand-information-security-manual-nzism::13.5.22.C.0113.5.22.C.01 Documented media and IT equipment destruction procedures
new-zealand-information-security-manual-nzism::13.5.23.C.0113.5.23.C.01 Approved destruction methods by media type
new-zealand-information-security-manual-nzism::13.5.24.C.0113.5.24.C.01 Use approved destruction equipment, facilities and methods
new-zealand-information-security-manual-nzism::13.5.24.C.0213.5.24.C.02 Use an approved facility when lacking own equipment
new-zealand-information-security-manual-nzism::13.5.24.C.0313.5.24.C.03 Non-approved facilities need WEEE-rated incineration and licensed operator
new-zealand-information-security-manual-nzism::13.5.24.C.0413.5.24.C.04 Safe WEEE handling at non-approved facilities
new-zealand-information-security-manual-nzism::13.5.25.C.0113.5.25.C.01 Treatment of destruction waste by particle size
new-zealand-information-security-manual-nzism::13.5.26.C.0113.5.26.C.01 Degausser field strength matches media coercivity
new-zealand-information-security-manual-nzism::13.5.26.C.0213.5.26.C.02 Degausser evaluated for media magnetic orientation
new-zealand-information-security-manual-nzism::13.5.26.C.0313.5.26.C.03 Follow manufacturer and GCSB degausser directions
new-zealand-information-security-manual-nzism::13.5.27.C.0113.5.27.C.01 Cleared supervisor for media destruction
new-zealand-information-security-manual-nzism::13.5.27.C.0213.5.27.C.02 Duties of personnel supervising destruction
new-zealand-information-security-manual-nzism::13.5.27.C.0313.5.27.C.03 Destruction Register contents
new-zealand-information-security-manual-nzism::13.5.28.C.0113.5.28.C.01 Two cleared supervisors for accountable material destruction
new-zealand-information-security-manual-nzism::13.5.28.C.0213.5.28.C.02 Duties when supervising accountable material destruction
new-zealand-information-security-manual-nzism::13.5.29.C.0113.5.29.C.01 No outsourcing supervision of TOP SECRET or NZEO destruction
new-zealand-information-security-manual-nzism::13.5.29.C.0213.5.29.C.02 Outsourced destruction uses approved commercial facility
new-zealand-information-security-manual-nzism::13.5.30.C.0113.5.30.C.01 Sanitise before transport to offsite destruction
new-zealand-information-security-manual-nzism::13.6.10.C.0113.6.10.C.01 NZEO media sanitised then redeployed or destroyed
new-zealand-information-security-manual-nzism::13.6.10.C.0213.6.10.C.02 Approved destruction facility for NZEO disposal
new-zealand-information-security-manual-nzism::13.6.10.C.0313.6.10.C.03 NZEO media never e-recycled or sold
new-zealand-information-security-manual-nzism::13.6.11.C.0113.6.11.C.01 Agency-run destruction facilities need Director-General GCSB approval
new-zealand-information-security-manual-nzism::13.6.12.C.0113.6.12.C.01 Use approved secure destruction facility for media
new-zealand-information-security-manual-nzism::13.6.6.C.0113.6.6.C.01 Declassify media before public-domain disposal
new-zealand-information-security-manual-nzism::13.6.6.C.0213.6.6.C.02 Destroy items that cannot be sanitised or declassified
new-zealand-information-security-manual-nzism::13.6.7.C.0113.6.7.C.01 Documented media and IT equipment disposal procedures
new-zealand-information-security-manual-nzism::13.6.8.C.0113.6.8.C.01 Conditions for declassifying media
new-zealand-information-security-manual-nzism::13.6.9.C.0113.6.9.C.01 Dispose of media without revealing prior classification

Chapter 14: Software security – New Zealand Information Security Manual (NZISM)

51 controls
Controls in the Chapter 14: Software security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 51 controls
CodeTitle
new-zealand-information-security-manual-nzism::14.1.10.C.0114.1.10.C.01 Remove default accounts and passwords on classified SOEs
new-zealand-information-security-manual-nzism::14.1.10.C.0214.1.10.C.02 Remove default accounts and passwords on all SOEs
new-zealand-information-security-manual-nzism::14.1.11.C.0114.1.11.C.01 Separate high-risk servers exposed to public networks
new-zealand-information-security-manual-nzism::14.1.12.C.0114.1.12.C.01 Characterise critical and high-risk servers
new-zealand-information-security-manual-nzism::14.1.12.C.0214.1.12.C.02 Approved algorithm for characterisation checksums
new-zealand-information-security-manual-nzism::14.1.12.C.0314.1.12.C.03 Link characterisation to BCP, DRP and BIA
new-zealand-information-security-manual-nzism::14.1.13.C.0114.1.13.C.01 Review applications for unplanned outbound connections
new-zealand-information-security-manual-nzism::14.1.13.C.0214.1.13.C.02 Business decision on automated outbound connections
new-zealand-information-security-manual-nzism::14.1.13.C.0314.1.13.C.03 Consider DLP for software outbound connections
new-zealand-information-security-manual-nzism::14.1.14.C.0114.1.14.C.01 Limit disclosure of installed software and versions
new-zealand-information-security-manual-nzism::14.1.8.C.0114.1.8.C.01 Build hardened SOEs for workstations and servers
new-zealand-information-security-manual-nzism::14.1.9.C.0114.1.9.C.01 Maintain SOE specifications, configurations and patching
new-zealand-information-security-manual-nzism::14.1.9.C.0214.1.9.C.02 Malware protection settings for servers and workstations
new-zealand-information-security-manual-nzism::14.2.4.C.0114.2.4.C.01 Application allow listing in the SOE
new-zealand-information-security-manual-nzism::14.2.5.C.0114.2.5.C.01 Users cannot disable application allow listing
new-zealand-information-security-manual-nzism::14.2.5.C.0214.2.5.C.02 Prevent users running arbitrary executables
new-zealand-information-security-manual-nzism::14.2.5.C.0314.2.5.C.03 Restrict users to predefined executables
new-zealand-information-security-manual-nzism::14.2.5.C.0414.2.5.C.04 Allow listing does not replace antivirus
new-zealand-information-security-manual-nzism::14.2.6.C.0114.2.6.C.01 Administrators not automatically exempt from allow listing
new-zealand-information-security-manual-nzism::14.2.7.C.0114.2.7.C.01 Default-deny execution policy
new-zealand-information-security-manual-nzism::14.2.7.C.0214.2.7.C.02 Combine allow listing with ACLs and limited privilege
new-zealand-information-security-manual-nzism::14.2.7.C.0314.2.7.C.03 Plan and test allow listing before rollout
new-zealand-information-security-manual-nzism::14.2.7.C.0414.2.7.C.04 Preferred order of allow listing rule types
new-zealand-information-security-manual-nzism::14.2.7.C.0514.2.7.C.05 Restrict process creation by allowed executables
new-zealand-information-security-manual-nzism::14.2.7.C.0614.2.7.C.06 Validate executable behaviour and permissions
new-zealand-information-security-manual-nzism::14.2.7.C.0714.2.7.C.07 Allow listing logs capture relevant information
new-zealand-information-security-manual-nzism::14.3.10.C.0114.3.10.C.01 Allow listing for all gateway HTTP traffic
new-zealand-information-security-manual-nzism::14.3.10.C.0214.3.10.C.02 Specify encrypted-connection allow list by domain or IP
new-zealand-information-security-manual-nzism::14.3.10.C.0314.3.10.C.03 Deny list known malicious websites when not allow listing
new-zealand-information-security-manual-nzism::14.3.10.C.0414.3.10.C.04 Update website deny lists frequently
new-zealand-information-security-manual-nzism::14.3.11.C.0114.3.11.C.01 Block low-value client-side active content
new-zealand-information-security-manual-nzism::14.3.11.C.0214.3.11.C.02 Per-site JavaScript control and blocking malicious functions
new-zealand-information-security-manual-nzism::14.3.12.C.0114.3.12.C.01 Web proxy content filtering
new-zealand-information-security-manual-nzism::14.3.13.C.0114.3.13.C.01 No agency credentials on external websites
new-zealand-information-security-manual-nzism::14.3.13.C.0214.3.13.C.02 Do not store website credentials on devices
new-zealand-information-security-manual-nzism::14.3.13.C.0314.3.13.C.03 No password reuse across websites
new-zealand-information-security-manual-nzism::14.3.5.C.0114.3.5.C.01 Web usage policy
new-zealand-information-security-manual-nzism::14.3.6.C.0114.3.6.C.01 Route all browsing through a Web proxy
new-zealand-information-security-manual-nzism::14.3.6.C.0214.3.6.C.02 Proxy authentication and minimum logging fields
new-zealand-information-security-manual-nzism::14.3.6.C.0314.3.6.C.03 Block executable downloads without approved need
new-zealand-information-security-manual-nzism::14.3.7.C.0114.3.7.C.01 Disable auto-launch of downloaded files
new-zealand-information-security-manual-nzism::14.3.8.C.0114.3.8.C.01 TLS inspection or URL allow list at gateways
new-zealand-information-security-manual-nzism::14.3.9.C.0114.3.9.C.01 Legal advice on TLS inspection
new-zealand-information-security-manual-nzism::14.4.4.C.0114.4.4.C.01 Separated and controlled software development environments
new-zealand-information-security-manual-nzism::14.4.5.C.0114.4.5.C.01 Secure programming practices for developers
new-zealand-information-security-manual-nzism::14.4.6.C.0114.4.6.C.01 Vulnerability review or testing before production
new-zealand-information-security-manual-nzism::14.4.6.C.0214.4.6.C.02 Independent review of software
new-zealand-information-security-manual-nzism::14.4.6.C.0314.4.6.C.03 Follow secure coding and agency development standards
new-zealand-information-security-manual-nzism::14.5.6.C.0114.5.6.C.01 Review web server active content for known issues
new-zealand-information-security-manual-nzism::14.5.7.C.0114.5.7.C.01 Minimise connectivity between web application components
new-zealand-information-security-manual-nzism::14.5.8.C.0114.5.8.C.01 Build web applications to OWASP guidance

Chapter 15: Email security – New Zealand Information Security Manual (NZISM)

53 controls
Controls in the Chapter 15: Email security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 53 controls
CodeTitle
new-zealand-information-security-manual-nzism::15.1.10.C.0115.1.10.C.01 Restrict selectable markings to the system's accreditation level
new-zealand-information-security-manual-nzism::15.1.10.C.0215.1.10.C.02 No automatic marking insertion without user action
new-zealand-information-security-manual-nzism::15.1.10.C.0315.1.10.C.03 Prevent downgrading markings on replies and forwards
new-zealand-information-security-manual-nzism::15.1.11.C.0115.1.11.C.01 Every email carries a protective marking
new-zealand-information-security-manual-nzism::15.1.11.C.0215.1.11.C.02 Email marking reflects the highest classified element
new-zealand-information-security-manual-nzism::15.1.11.C.0315.1.11.C.03 Place marking in subject line or header
new-zealand-information-security-manual-nzism::15.1.12.C.0115.1.12.C.01 Assess unmarked email received from outside government
new-zealand-information-security-manual-nzism::15.1.13.C.0115.1.13.C.01 Do not mark purely personal emails
new-zealand-information-security-manual-nzism::15.1.14.C.0115.1.14.C.01 Contact originator of unmarked government email
new-zealand-information-security-manual-nzism::15.1.15.C.0115.1.15.C.01 Query originator about unknown protective markings
new-zealand-information-security-manual-nzism::15.1.16.C.0115.1.16.C.01 Print markings in capitals at top and bottom
new-zealand-information-security-manual-nzism::15.1.17.C.0115.1.17.C.01 Avoid sending or clicking active links in email
new-zealand-information-security-manual-nzism::15.1.18.C.0115.1.18.C.01 Make users aware of email usage policies
new-zealand-information-security-manual-nzism::15.1.19.C.0115.1.19.C.01 Monitor staff compliance with email policies
new-zealand-information-security-manual-nzism::15.1.19.C.0215.1.19.C.02 Enforce approved government email systems such as SEEMAIL
new-zealand-information-security-manual-nzism::15.1.20.C.0115.1.20.C.01 Block public web-based email for official business
new-zealand-information-security-manual-nzism::15.1.7.C.0115.1.7.C.01 Documented and implemented email usage policy
new-zealand-information-security-manual-nzism::15.1.8.C.0115.1.8.C.01 Send nationality-restricted email only to named recipients
new-zealand-information-security-manual-nzism::15.1.8.C.0215.1.8.C.02 No releasability-marked email to unverified distribution lists
new-zealand-information-security-manual-nzism::15.1.9.C.0115.1.9.C.01 Apply protective markings per the national classification system
new-zealand-information-security-manual-nzism::15.2.36.C.0115.2.36.C.01 DMARC implementation prerequisites
new-zealand-information-security-manual-nzism::15.2.36.C.0215.2.36.C.02 Enforce DMARC p=reject on all agency domains
new-zealand-information-security-manual-nzism::15.2.36.C.0315.2.36.C.03 Handle received DMARC messages per published policy
new-zealand-information-security-manual-nzism::15.2.36.C.0415.2.36.C.04 Regularly review DMARC reports and remediate issues
new-zealand-information-security-manual-nzism::15.2.36.C.0515.2.36.C.05 Generate DMARC failure and aggregate reports
new-zealand-information-security-manual-nzism::15.2.37.C.0115.2.37.C.01 Email gateway filtering of suspicious content and spoofing
new-zealand-information-security-manual-nzism::15.2.38.C.0115.2.38.C.01 Strip active links from email at the server
new-zealand-information-security-manual-nzism::15.2.39.C.0115.2.39.C.01 Block unmarked or wrongly marked email on classified systems
new-zealand-information-security-manual-nzism::15.2.39.C.0215.2.39.C.02 Mandatory email marking on classified systems
new-zealand-information-security-manual-nzism::15.2.39.C.0315.2.39.C.03 Mandatory email marking to support filtering
new-zealand-information-security-manual-nzism::15.2.40.C.0115.2.40.C.01 Block outbound email exceeding path classification
new-zealand-information-security-manual-nzism::15.2.40.C.0215.2.40.C.02 Log all blocked outbound emails
new-zealand-information-security-manual-nzism::15.2.41.C.0115.2.41.C.01 Reject, log and report over-classified inbound email
new-zealand-information-security-manual-nzism::15.2.41.C.0215.2.41.C.02 Tell intended recipients about blocked email
new-zealand-information-security-manual-nzism::15.2.42.C.0115.2.42.C.01 Send bounce notices only to verified senders
new-zealand-information-security-manual-nzism::15.2.43.C.0115.2.43.C.01 Apply blocking rules to auto-forwarded email
new-zealand-information-security-manual-nzism::15.2.44.C.0115.2.44.C.01 Disable open relaying on email servers
new-zealand-information-security-manual-nzism::15.2.45.C.0115.2.45.C.01 Regular email server audits and vulnerability analysis
new-zealand-information-security-manual-nzism::15.2.46.C.0115.2.46.C.01 Authenticated encrypted channel for remote email sending
new-zealand-information-security-manual-nzism::15.2.46.C.0215.2.46.C.02 Route all email via a centralised gateway
new-zealand-information-security-manual-nzism::15.2.46.C.0315.2.46.C.03 Maintain backup gateways to primary standard
new-zealand-information-security-manual-nzism::15.2.47.C.0115.2.47.C.01 Opportunistic TLS per RFC 3207 on public mail connections
new-zealand-information-security-manual-nzism::15.2.47.C.0215.2.47.C.02 TLS between servers for heavy classified email flows
new-zealand-information-security-manual-nzism::15.2.48.C.0115.2.48.C.01 Enable MTA-STS for email transfer
new-zealand-information-security-manual-nzism::15.2.48.C.0215.2.48.C.02 TLS 1.2 or above for MTA-STS
new-zealand-information-security-manual-nzism::15.2.48.C.0315.2.48.C.03 Enable TLS reporting with MTA-STS
new-zealand-information-security-manual-nzism::15.2.49.C.0115.2.49.C.01 Publish SPF and flag SPF-failing inbound email
new-zealand-information-security-manual-nzism::15.2.49.C.0215.2.49.C.02 Hard-fail SPF record and SPF verification of inbound mail
new-zealand-information-security-manual-nzism::15.2.49.C.0315.2.49.C.03 Follow RFC 7208 SPF recommendations
new-zealand-information-security-manual-nzism::15.2.50.C.0115.2.50.C.01 DKIM-sign all outgoing agency email
new-zealand-information-security-manual-nzism::15.2.50.C.0215.2.50.C.02 Use DKIM together with SPF
new-zealand-information-security-manual-nzism::15.2.50.C.0315.2.50.C.03 Verify DKIM on inbound email, allowing for list software
new-zealand-information-security-manual-nzism::15.2.50.C.0415.2.50.C.04 List software must preserve external senders' DKIM validity

Chapter 16: Authentication and Access Controls – New Zealand Information Security Manual (NZISM)

101 controls
Controls in the Chapter 16: Authentication and Access Controls – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 101 controls
CodeTitle
new-zealand-information-security-manual-nzism::16.1.24.C.0116.1.24.C.01 Identity, authentication and authorisation policies communicated to users
new-zealand-information-security-manual-nzism::16.1.25.C.0116.1.25.C.01 Zero Trust design for stronger identity management
new-zealand-information-security-manual-nzism::16.1.26.C.0116.1.26.C.01 Unique user identity with authentication at every access
new-zealand-information-security-manual-nzism::16.1.27.C.0216.1.27.C.02 No shared credentials for privileged or administrator accounts
new-zealand-information-security-manual-nzism::16.1.27.C.0316.1.27.C.03 Avoid shared credentials for any account
new-zealand-information-security-manual-nzism::16.1.28.C.0116.1.28.C.01 Independent user identification when shared accounts are allowed
new-zealand-information-security-manual-nzism::16.1.29.C.0216.1.29.C.02 Use MFA to identify and authenticate users
new-zealand-information-security-manual-nzism::16.1.30.C.0116.1.30.C.01 Risk assessment of centralised access management and SSO
new-zealand-information-security-manual-nzism::16.1.31.C.0116.1.31.C.01 Password policies enforced across all systems
new-zealand-information-security-manual-nzism::16.1.31.C.0216.1.31.C.02 Annual password change where no MFA or passwordless
new-zealand-information-security-manual-nzism::16.1.31.C.0316.1.31.C.03 Minimum 16-character long, unique passwords
new-zealand-information-security-manual-nzism::16.1.31.C.0416.1.31.C.04 Minimum safeguards so authentication does not weaken security
new-zealand-information-security-manual-nzism::16.1.31.C.0516.1.31.C.05 No predictable resets, cleartext storage or reused reset passwords
new-zealand-information-security-manual-nzism::16.1.31.C.0616.1.31.C.06 Consider location-based authentication factors
new-zealand-information-security-manual-nzism::16.1.31.C.0716.1.31.C.07 Consider annual password changes in password policy
new-zealand-information-security-manual-nzism::16.1.33.C.01/CID183216.1.33.C.01 No shared credentials on classified systems
new-zealand-information-security-manual-nzism::16.1.33.C.01/CID184716.1.33.C.01 Protect authentication data while in transit
new-zealand-information-security-manual-nzism::16.1.34.C.0116.1.34.C.01 Hash stored passwords and secrets with approved algorithms
new-zealand-information-security-manual-nzism::16.1.34.C.0216.1.34.C.02 Salted, HMAC-hashed and stretched storage of secrets
new-zealand-information-security-manual-nzism::16.1.35.C.0116.1.35.C.01 No PIN or numeric password as sole authentication
new-zealand-information-security-manual-nzism::16.1.36.C.01/CID184416.1.36.C.01 Keep unprotected credentials away from what they unlock
new-zealand-information-security-manual-nzism::16.1.36.C.01/CID187516.1.36.C.01 Verify account ownership before password or MFA reset
new-zealand-information-security-manual-nzism::16.1.36.C.0216.1.36.C.02 Temporary passwords on administrator-set resets
new-zealand-information-security-manual-nzism::16.1.36.C.0316.1.36.C.03 Avoid single-factor changes to MFA details
new-zealand-information-security-manual-nzism::16.1.37.C.0116.1.37.C.01 Password manager master passwords follow agency policy
new-zealand-information-security-manual-nzism::16.1.37.C.0216.1.37.C.02 Consider MFA for password manager access
new-zealand-information-security-manual-nzism::16.1.38.C.0116.1.38.C.01 Risk-assess passwordless authentication options
new-zealand-information-security-manual-nzism::16.1.39.C.01/CID185016.1.39.C.01 Mechanism to identify foreign national users
new-zealand-information-security-manual-nzism::16.1.39.C.01/CID755416.1.39.C.01 Disable replay-susceptible authentication methods
new-zealand-information-security-manual-nzism::16.1.39.C.02/CID185116.1.39.C.02 Record specific nationality of foreign users on NZEO systems
new-zealand-information-security-manual-nzism::16.1.39.C.02/CID187816.1.39.C.02 Disable LAN Manager password authentication
new-zealand-information-security-manual-nzism::16.1.40.C.0116.1.40.C.01 Automatic logout and shutdown after inactivity
new-zealand-information-security-manual-nzism::16.1.41.C.0116.1.41.C.01 Enforced screen and session lock on classified systems
new-zealand-information-security-manual-nzism::16.1.41.C.0216.1.41.C.02 Screen and session lock on all systems
new-zealand-information-security-manual-nzism::16.1.42.C.0116.1.42.C.01 Logon recording, lockout and account removal rules
new-zealand-information-security-manual-nzism::16.1.44.C.0316.1.44.C.03 Required topics for logon banner content
new-zealand-information-security-manual-nzism::16.1.47.C.0116.1.47.C.01 Investigate repeated lockouts before restoring access
new-zealand-information-security-manual-nzism::16.1.48.C.0116.1.48.C.01 Logon banner requiring acceptance of responsibilities
new-zealand-information-security-manual-nzism::16.1.48.C.0216.1.48.C.02 Legal advice on logon banner wording
new-zealand-information-security-manual-nzism::16.2.3.C.0116.2.3.C.01 No NZEO access from foreign-controlled systems
new-zealand-information-security-manual-nzism::16.2.3.C.0216.2.3.C.02 Classified access from foreign systems only under agreement
new-zealand-information-security-manual-nzism::16.2.4.C.01/CID192416.2.4.C.01 Access controls enforce user authorisations
new-zealand-information-security-manual-nzism::16.2.4.C.01/CID193016.2.4.C.01 Defined eight-stage process for building access control lists
new-zealand-information-security-manual-nzism::16.2.6.C.0116.2.6.C.01 System-enforced restriction of compartmented information
new-zealand-information-security-manual-nzism::16.3.5.C.0116.3.5.C.01 Controlled, individual and minimal use of privileged accounts
new-zealand-information-security-manual-nzism::16.3.6.C.0116.3.6.C.01 No foreign national privileged access to NZEO systems
new-zealand-information-security-manual-nzism::16.3.6.C.0216.3.6.C.02 Avoid foreign national privileged access to classified systems
new-zealand-information-security-manual-nzism::16.3.7.C.0116.3.7.C.01 Appropriately cleared privileged user for down-classification transfers
new-zealand-information-security-manual-nzism::16.4.30.C.0116.4.30.C.01 Establish a Privileged Access Management policy
new-zealand-information-security-manual-nzism::16.4.31.C.0116.4.31.C.01 Least privilege built into the PAM policy
new-zealand-information-security-manual-nzism::16.4.32.C.0116.4.32.C.01 Formal approval process before issuing privileged credentials
new-zealand-information-security-manual-nzism::16.4.32.C.0216.4.32.C.02 No privileged credentials without formal approval
new-zealand-information-security-manual-nzism::16.4.33.C.0116.4.33.C.01 Privileged credential suspension and revocation procedures
new-zealand-information-security-manual-nzism::16.4.34.C.0116.4.34.C.01 Inventory of privileged accounts, rights and credentials
new-zealand-information-security-manual-nzism::16.4.35.C.0116.4.35.C.01 Continuous discovery, monitoring and review of privileged accounts
new-zealand-information-security-manual-nzism::16.4.35.C.0316.4.35.C.03 Restrict and protect access to audit logs
new-zealand-information-security-manual-nzism::16.4.36.C.0116.4.36.C.01 PAM response and remediation policy and procedure
new-zealand-information-security-manual-nzism::16.4.36.C.0216.4.36.C.02 PAM policy defines privileged account and access
new-zealand-information-security-manual-nzism::16.4.36.C.0316.4.36.C.03 Manage privileged accounts under the PAM policy
new-zealand-information-security-manual-nzism::16.4.37.C.0116.4.37.C.01 PAM training module in user awareness programme
new-zealand-information-security-manual-nzism::16.4.37.C.0216.4.37.C.02 Two-factor or MFA for privileged account access
new-zealand-information-security-manual-nzism::16.4.37.C.0316.4.37.C.03 Consider time-bound privileged access revocation
new-zealand-information-security-manual-nzism::16.4.39.C.0216.4.39.C.02 Investigate signs of credential compromise or misuse
new-zealand-information-security-manual-nzism::16.4.41.C.0216.4.41.C.02 Privileged monitoring records user activity and anomalies
new-zealand-information-security-manual-nzism::16.5.10.C.0116.5.10.C.01 Authenticate every remote connection and user
new-zealand-information-security-manual-nzism::16.5.10.C.0216.5.10.C.02 Authenticate both remote user and device
new-zealand-information-security-manual-nzism::16.5.11.C.0116.5.11.C.01 No remote privileged access from untrusted domains (classified)
new-zealand-information-security-manual-nzism::16.5.11.C.0216.5.11.C.02 Avoid remote privileged access from untrusted domains
new-zealand-information-security-manual-nzism::16.5.12.C.0116.5.12.C.01 VPN for all remote access connections
new-zealand-information-security-manual-nzism::16.5.12.C.0216.5.12.C.02 Zero Trust with VPN and users unable to disable it
new-zealand-information-security-manual-nzism::16.6.10.C.0116.6.10.C.01 Component-specific events to log (database, OS, web)
new-zealand-information-security-manual-nzism::16.6.10.C.0216.6.10.C.02 Minimum events logged for all software components
new-zealand-information-security-manual-nzism::16.6.11.C.0116.6.11.C.01 Required fields in each logged event
new-zealand-information-security-manual-nzism::16.6.11.C.0216.6.11.C.02 Establish an authoritative time source
new-zealand-information-security-manual-nzism::16.6.11.C.0316.6.11.C.03 Synchronise logs and audit trails to the time source
new-zealand-information-security-manual-nzism::16.6.12.C.0116.6.12.C.01 Protect event logs from change, access and loss
new-zealand-information-security-manual-nzism::16.6.12.C.0216.6.12.C.02 Send event logs promptly to separate secure servers (classified)
new-zealand-information-security-manual-nzism::16.6.12.C.0316.6.12.C.03 Separate log server and integrity-preserving archives
new-zealand-information-security-manual-nzism::16.6.13.C.0116.6.13.C.01 Archive and retain event logs for agency-set period
new-zealand-information-security-manual-nzism::16.6.13.C.0216.6.13.C.02 Log disposal and archiving follow legislation
new-zealand-information-security-manual-nzism::16.6.13.C.0316.6.13.C.03 Determine whether logs are subject to legislation
new-zealand-information-security-manual-nzism::16.6.13.C.0416.6.13.C.04 Retain DNS, proxy and event logs 12 months
new-zealand-information-security-manual-nzism::16.6.13.C.0516.6.13.C.05 Prioritise log retention by sensitive-system risk
new-zealand-information-security-manual-nzism::16.6.14.C.0116.6.14.C.01 Documented event log audit requirements
new-zealand-information-security-manual-nzism::16.6.15.C.0116.6.15.C.01 Monitoring solution for timely incident detection
new-zealand-information-security-manual-nzism::16.6.15.C.0216.6.15.C.02 Near real-time log correlation for anomalies
new-zealand-information-security-manual-nzism::16.6.6.C.0116.6.6.C.01 Keep system management logs for system life (TOP SECRET)
new-zealand-information-security-manual-nzism::16.6.6.C.0216.6.6.C.02 Retention policy for system management logs
new-zealand-information-security-manual-nzism::16.6.7.C.0116.6.7.C.01 Minimum content of system management logs
new-zealand-information-security-manual-nzism::16.6.8.C.0116.6.8.C.01 Documented logging requirements
new-zealand-information-security-manual-nzism::16.6.9.C.0116.6.9.C.01 Minimum logged events on classified systems
new-zealand-information-security-manual-nzism::16.7.33.C.0116.7.33.C.01 Risk analysis before MFA design
new-zealand-information-security-manual-nzism::16.7.44.C.0116.7.44.C.01 MFA design considerations (first listing)
new-zealand-information-security-manual-nzism::16.7.44.C.0216.7.44.C.02 MFA for privileged users and secure credential reset
new-zealand-information-security-manual-nzism::16.7.44.C.0316.7.44.C.03 MFA on all remote-access user accounts
new-zealand-information-security-manual-nzism::16.7.44.C.0416.7.44.C.04 MFA on all user accounts
new-zealand-information-security-manual-nzism::16.7.44.C.0516.7.44.C.05 Phishing-resistant MFA for administration accounts
new-zealand-information-security-manual-nzism::16.7.44.C.0616.7.44.C.06 Phishing-resistant MFA for user authentication
new-zealand-information-security-manual-nzism::16.7.44.C.0716.7.44.C.07 MFA design considerations (repeated listing)
new-zealand-information-security-manual-nzism::16.7.45.C.0116.7.45.C.01 Integrate MFA with security, PAM and password policies
new-zealand-information-security-manual-nzism::16.7.46.C.0116.7.46.C.01 User training on MFA risks and safe use

Chapter 17: Cryptography – New Zealand Information Security Manual (NZISM)

82 controls
Controls in the Chapter 17: Cryptography – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 82 controls
CodeTitle
new-zealand-information-security-manual-nzism::17.1.51.C.0117.1.51.C.01 Cryptographic products must hold a GCSB-recognised evaluation
new-zealand-information-security-manual-nzism::17.1.52.C.0117.1.52.C.01 Data recovery capability in cryptographic products (classified systems)
new-zealand-information-security-manual-nzism::17.1.52.C.0217.1.52.C.02 Data recovery capability in cryptographic products
new-zealand-information-security-manual-nzism::17.1.53.C.0117.1.53.C.01 Encryption for reduced handling needs uses approved algorithms
new-zealand-information-security-manual-nzism::17.1.53.C.0217.1.53.C.02 HACE required to reduce handling of classified media
new-zealand-information-security-manual-nzism::17.1.53.C.0317.1.53.C.03 Full or partial disk encryption for classified equipment
new-zealand-information-security-manual-nzism::17.1.53.C.0417.1.53.C.04 Full or partial disk encryption for reduced handling
new-zealand-information-security-manual-nzism::17.1.54.C.0117.1.54.C.01 Approved algorithm to protect NZEO data at rest
new-zealand-information-security-manual-nzism::17.1.55.C.0117.1.55.C.01 HACE for classified data over insecure networks
new-zealand-information-security-manual-nzism::17.1.55.C.0217.1.55.C.02 Encrypt RESTRICTED or SENSITIVE traffic on insecure networks
new-zealand-information-security-manual-nzism::17.1.55.C.0317.1.55.C.03 Encrypt aggregated data over untrusted networks
new-zealand-information-security-manual-nzism::17.1.55.C.0417.1.55.C.04 Encrypt agency data sent over insecure networks
new-zealand-information-security-manual-nzism::17.1.56.C.0117.1.56.C.01 Powered-on encrypted equipment keeps original classification
new-zealand-information-security-manual-nzism::17.1.56.C.0217.1.56.C.02 Consult GCSB on powered-off treatment of equipment
new-zealand-information-security-manual-nzism::17.1.57.C.0117.1.57.C.01 Approved protocol and algorithm for NZEO data in transit
new-zealand-information-security-manual-nzism::17.1.58.C.0117.1.58.C.01 Set cryptoperiods for all keys
new-zealand-information-security-manual-nzism::17.1.58.C.0217.1.58.C.02 Risk-based approach to setting cryptoperiods
new-zealand-information-security-manual-nzism::17.1.58.C.0317.1.58.C.03 Consult GCSB on HACE key management
new-zealand-information-security-manual-nzism::17.10.12.C.0117.10.12.C.01 Consider HSMs in risk assessment and design (classified)
new-zealand-information-security-manual-nzism::17.10.12.C.0217.10.12.C.02 Follow product selection guidance for HSMs (classified)
new-zealand-information-security-manual-nzism::17.10.12.C.0317.10.12.C.03 Consider HSMs in risk assessment and design
new-zealand-information-security-manual-nzism::17.10.12.C.0417.10.12.C.04 Follow product selection guidance for HSMs
new-zealand-information-security-manual-nzism::17.2.17.C.0117.2.17.C.01 Restrict mixed-algorithm unevaluated products to approved algorithms
new-zealand-information-security-manual-nzism::17.2.18.C.0117.2.18.C.01 Prefer ECDH and ECDSA for new systems
new-zealand-information-security-manual-nzism::17.2.19.C.0117.2.19.C.01 DH modulus of at least 3072 bits
new-zealand-information-security-manual-nzism::17.2.20.C.0117.2.20.C.01 Reconfigure devices to longest feasible key length
new-zealand-information-security-manual-nzism::17.2.20.C.0217.2.20.C.02 Schedule replacement of devices lacking required key lengths
new-zealand-information-security-manual-nzism::17.2.21.C.0117.2.21.C.01 DSA modulus of at least 1024 bits (legacy)
new-zealand-information-security-manual-nzism::17.2.22.C.0117.2.22.C.01 ECDH must use curve P-384
new-zealand-information-security-manual-nzism::17.2.22.C.0217.2.22.C.02 Replace short pre-shared keys on ECDH VPNs
new-zealand-information-security-manual-nzism::17.2.23.C.0117.2.23.C.01 ECDSA must use curve P-384
new-zealand-information-security-manual-nzism::17.2.24.C.0117.2.24.C.01 RSA modulus of at least 3072 bits
new-zealand-information-security-manual-nzism::17.2.24.C.0217.2.24.C.02 Separate RSA keys for key transport and signing
new-zealand-information-security-manual-nzism::17.2.24.C.0317.2.24.C.03 Prefer RSA modulus of 4096 bits
new-zealand-information-security-manual-nzism::17.2.25.C.0117.2.25.C.01 RSA keys in X.509 PKI certificates of 2048 bits or more
new-zealand-information-security-manual-nzism::17.2.26.C.0117.2.26.C.01 SHA-2 for new systems, SHA-1 only for legacy
new-zealand-information-security-manual-nzism::17.2.26.C.0217.2.26.C.02 SHA-384 minimum for RESTRICTED or higher integrity
new-zealand-information-security-manual-nzism::17.2.26.C.0317.2.26.C.03 SHA-256 minimum for other integrity hashing
new-zealand-information-security-manual-nzism::17.2.27.C.0117.2.27.C.01 Store passwords resistant to offline attack
new-zealand-information-security-manual-nzism::17.2.27.C.0217.2.27.C.02 Salt and hash passwords with a key derivation function
new-zealand-information-security-manual-nzism::17.2.27.C.0317.2.27.C.03 Salt length and uniqueness requirements
new-zealand-information-security-manual-nzism::17.2.28.C.0117.2.28.C.01 Avoid ECB mode for symmetric encryption
new-zealand-information-security-manual-nzism::17.3.6.C.0117.3.6.C.01 Allow only approved protocols in protocol-capable products
new-zealand-information-security-manual-nzism::17.4.16.C.0117.4.16.C.01 Use TLS 1.3
new-zealand-information-security-manual-nzism::17.4.16.C.0217.4.16.C.02 Do not use SSL
new-zealand-information-security-manual-nzism::17.5.10.C.0117.5.10.C.01 Keep SSH software current
new-zealand-information-security-manual-nzism::17.5.6.C.0117.5.6.C.01 SSH daemon configuration settings
new-zealand-information-security-manual-nzism::17.5.7.C.0117.5.7.C.01 Prefer public key authentication for SSH
new-zealand-information-security-manual-nzism::17.5.7.C.0217.5.7.C.02 Block brute force against SSH passwords
new-zealand-information-security-manual-nzism::17.5.8.C.0117.5.8.C.01 Parameter checking for SSH forced commands
new-zealand-information-security-manual-nzism::17.5.8.C.0217.5.8.C.02 Restrict passwordless SSH logins used for automation
new-zealand-information-security-manual-nzism::17.5.8.C.0317.5.8.C.03 Use forced command for passwordless remote access
new-zealand-information-security-manual-nzism::17.5.9.C.0117.5.9.C.01 Safe use of SSH-agent and key caching
new-zealand-information-security-manual-nzism::17.6.6.C.0117.6.6.C.01 Sanitise decommissioned S/MIME equipment
new-zealand-information-security-manual-nzism::17.6.7.C.0117.6.7.C.01 No S/MIME versions older than 3.0
new-zealand-information-security-manual-nzism::17.7.6.C.0117.7.6.C.01 Revoke OpenPGP keys on suspected compromise
new-zealand-information-security-manual-nzism::17.8.10.C.0117.8.10.C.01 Use IPSec tunnel mode
new-zealand-information-security-manual-nzism::17.8.10.C.0217.8.10.C.02 Add IP tunnel when IPSec transport mode is used
new-zealand-information-security-manual-nzism::17.8.11.C.0117.8.11.C.01 Use ESP for IPSec
new-zealand-information-security-manual-nzism::17.8.12.C.0117.8.12.C.01 Disable IKE aggressive mode
new-zealand-information-security-manual-nzism::17.8.13.C.0117.8.13.C.01 IPSec security association lifetime of four hours or less
new-zealand-information-security-manual-nzism::17.8.14.C.0117.8.14.C.01 Approved HMAC algorithms for IPSec
new-zealand-information-security-manual-nzism::17.8.15.C.0117.8.15.C.01 Largest available DH modulus for IPSec
new-zealand-information-security-manual-nzism::17.8.16.C.0117.8.16.C.01 Enable Perfect Forward Secrecy on IPSec
new-zealand-information-security-manual-nzism::17.8.17.C.0117.8.17.C.01 Disable XAUTH for IKEv1
new-zealand-information-security-manual-nzism::17.9.30.C.0117.9.30.C.01 Assess risks of key ownership, possession and control
new-zealand-information-security-manual-nzism::17.9.30.C.0217.9.30.C.02 Key management plan for commercial grade cryptographic systems
new-zealand-information-security-manual-nzism::17.9.30.C.0317.9.30.C.03 KMP detail proportionate to criticality and classification
new-zealand-information-security-manual-nzism::17.9.31.C.0117.9.31.C.01 Minimum contents of a key management plan
new-zealand-information-security-manual-nzism::17.9.32.C.0117.9.32.C.01 Account for cryptographic material (classified systems)
new-zealand-information-security-manual-nzism::17.9.32.C.0217.9.32.C.02 Account for cryptographic material transactions
new-zealand-information-security-manual-nzism::17.9.33.C.0117.9.33.C.01 Two-person cryptographic audits
new-zealand-information-security-manual-nzism::17.9.33.C.0217.9.33.C.02 Triggers and frequency for cryptographic audits
new-zealand-information-security-manual-nzism::17.9.33.C.0317.9.33.C.03 Scope of cryptographic material audits
new-zealand-information-security-manual-nzism::17.9.34.C.0117.9.34.C.01 Maintain a cryptographic system access register
new-zealand-information-security-manual-nzism::17.9.35.C.0117.9.35.C.01 Preconditions for cryptographic system administrator access
new-zealand-information-security-manual-nzism::17.9.36.C.0117.9.36.C.01 House cryptographic equipment in a suitable server room
new-zealand-information-security-manual-nzism::17.9.36.C.0217.9.36.C.02 Designate controlled cryptography areas
new-zealand-information-security-manual-nzism::17.9.37.C.0117.9.37.C.01 Comply with NZCSI for HACE
new-zealand-information-security-manual-nzism::17.9.38.C.0117.9.38.C.01 Transport and manage unkeyed commercial grade equipment
new-zealand-information-security-manual-nzism::17.9.38.C.0217.9.38.C.02 Transport and store keyed commercial grade equipment by key classification
new-zealand-information-security-manual-nzism::17.9.38.C.0317.9.38.C.03 Avoid transporting commercial grade equipment while keyed

Chapter 18: Network security – New Zealand Information Security Manual (NZISM)

118 controls
Controls in the Chapter 18: Network security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 118 controls
CodeTitle
new-zealand-information-security-manual-nzism::18.1.10.C.0118.1.10.C.01 Network configuration controlled by a management authority
new-zealand-information-security-manual-nzism::18.1.10.C.0218.1.10.C.02 Formal change control for configuration changes
new-zealand-information-security-manual-nzism::18.1.10.C.0318.1.10.C.03 Regular review of network against documented configuration
new-zealand-information-security-manual-nzism::18.1.10.C.0418.1.10.C.04 Automated comparison of running and documented configuration
new-zealand-information-security-manual-nzism::18.1.11.C.0118.1.11.C.01 High-level and equipment network diagrams for every network
new-zealand-information-security-manual-nzism::18.1.12.C.0118.1.12.C.01 Keep classified network diagrams current and dated
new-zealand-information-security-manual-nzism::18.1.12.C.0218.1.12.C.02 Update network diagrams and date every page
new-zealand-information-security-manual-nzism::18.1.13.C.0118.1.13.C.01 Network access controls on all classified networks
new-zealand-information-security-manual-nzism::18.1.13.C.0218.1.13.C.02 Network access controls on every network
new-zealand-information-security-manual-nzism::18.1.14.C.0118.1.14.C.01 Protect network management traffic from unauthorised access
new-zealand-information-security-manual-nzism::18.1.15.C.0118.1.15.C.01 Avoid SNMP without a specific need
new-zealand-information-security-manual-nzism::18.1.15.C.0218.1.15.C.02 Use SNMPv3 where SNMP is required
new-zealand-information-security-manual-nzism::18.1.15.C.0318.1.15.C.03 Replace default SNMP community strings
new-zealand-information-security-manual-nzism::18.1.15.C.0418.1.15.C.04 Read-only SNMP access
new-zealand-information-security-manual-nzism::18.1.9.C.0118.1.9.C.01 Risk assessment before sharing network documentation externally
new-zealand-information-security-manual-nzism::18.1.9.C.0218.1.9.C.02 Classify network documentation at the data classification level
new-zealand-information-security-manual-nzism::18.1.9.C.0318.1.9.C.03 Limit third-party network documentation to need-to-know
new-zealand-information-security-manual-nzism::18.1.9.C.0418.1.9.C.04 Keep detailed network configuration out of tender documents
new-zealand-information-security-manual-nzism::18.1.9.C.0518.1.9.C.05 Weigh security when classifying network documentation
new-zealand-information-security-manual-nzism::18.2.10.C.0118.2.10.C.01 Evaluated 802.1X components on classified wireless
new-zealand-information-security-manual-nzism::18.2.10.C.0218.2.10.C.02 Product evaluation for 802.1X wireless components
new-zealand-information-security-manual-nzism::18.2.11.C.0118.2.11.C.01 Evaluated CA or HSM for wireless certificates
new-zealand-information-security-manual-nzism::18.2.11.C.0218.2.11.C.02 Device and user certificates held on separate devices
new-zealand-information-security-manual-nzism::18.2.11.C.0318.2.11.C.03 Unique certificates per device and per user
new-zealand-information-security-manual-nzism::18.2.11.C.0418.2.11.C.04 User wireless certificates on PIN-protected smart cards
new-zealand-information-security-manual-nzism::18.2.11.C.0518.2.11.C.05 Full disk encryption protecting stored device certificates
new-zealand-information-security-manual-nzism::18.2.12.C.0118.2.12.C.01 Validate server certificates and block untrusted CAs
new-zealand-information-security-manual-nzism::18.2.12.C.0218.2.12.C.02 Enable identity privacy on wireless devices
new-zealand-information-security-manual-nzism::18.2.13.C.0118.2.13.C.01 PMK cache period no longer than 24 hours
new-zealand-information-security-manual-nzism::18.2.14.C.0118.2.14.C.01 Extra encryption layer for access point to RADIUS traffic
new-zealand-information-security-manual-nzism::18.2.15.C.0118.2.15.C.01 Wireless cryptography at unclassified-infrastructure assurance
new-zealand-information-security-manual-nzism::18.2.16.C.0118.2.16.C.01 CCMP for all wireless traffic
new-zealand-information-security-manual-nzism::18.2.17.C.0118.2.17.C.01 Remove TKIP and WEP from access points
new-zealand-information-security-manual-nzism::18.2.18.C.0118.2.18.C.01 No WEP in wireless deployments
new-zealand-information-security-manual-nzism::18.2.19.C.0118.2.19.C.01 No WPA in wireless deployments
new-zealand-information-security-manual-nzism::18.2.19.C.0218.2.19.C.02 Avoid WPA2 in wireless deployments
new-zealand-information-security-manual-nzism::18.2.19.C.0318.2.19.C.03 Adopt WPA3, preferably Enterprise 192-bit mode
new-zealand-information-security-manual-nzism::18.2.20.C.0118.2.20.C.01 No pre-shared keys on classified wireless
new-zealand-information-security-manual-nzism::18.2.20.C.0218.2.20.C.02 Random maximum-length pre-shared keys
new-zealand-information-security-manual-nzism::18.2.20.C.0318.2.20.C.03 Avoid pre-shared keys for wireless authentication
new-zealand-information-security-manual-nzism::18.2.21.C.0118.2.21.C.01 Disable wireless-side admin interface on access points
new-zealand-information-security-manual-nzism::18.2.22.C.0118.2.22.C.01 Upgrade wireless to support 802.11w management frame protection
new-zealand-information-security-manual-nzism::18.2.23.C.0118.2.23.C.01 Change default SSID on access points
new-zealand-information-security-manual-nzism::18.2.23.C.0218.2.23.C.02 Rename or remove default accounts and passwords
new-zealand-information-security-manual-nzism::18.2.24.C.0118.2.24.C.01 SSID must not reveal agency, site or purpose
new-zealand-information-security-manual-nzism::18.2.25.C.0118.2.25.C.01 Keep SSID broadcasting enabled
new-zealand-information-security-manual-nzism::18.2.26.C.0118.2.26.C.01 Use DHCP for wireless IP addressing
new-zealand-information-security-manual-nzism::18.2.27.C.0118.2.27.C.01 Do not rely on MAC filtering for wireless security
new-zealand-information-security-manual-nzism::18.2.28.C.0118.2.28.C.01 Document wireless key management in the SecPlan
new-zealand-information-security-manual-nzism::18.2.28.C.0218.2.28.C.02 Record wireless drivers and versions in the SecPlan
new-zealand-information-security-manual-nzism::18.2.29.C.0118.2.29.C.01 Segregate BYOD wireless from all agency networks
new-zealand-information-security-manual-nzism::18.2.29.C.0218.2.29.C.02 BYOD devices meet Section 21.4 requirements
new-zealand-information-security-manual-nzism::18.2.29.C.0318.2.29.C.03 Keep non-agency devices off agency wireless
new-zealand-information-security-manual-nzism::18.2.30.C.0118.2.30.C.01 Agency devices kept off non-agency wireless networks
new-zealand-information-security-manual-nzism::18.2.31.C.0118.2.31.C.01 Treat wireless-to-fixed links like Internet connections
new-zealand-information-security-manual-nzism::18.2.32.C.0118.2.32.C.01 Many low-power access points instead of few high-power
new-zealand-information-security-manual-nzism::18.2.33.C.0118.2.33.C.01 Limit wireless range beyond the controlled area
new-zealand-information-security-manual-nzism::18.2.34.C.0118.2.34.C.01 Use channel separation between wireless networks
new-zealand-information-security-manual-nzism::18.2.5.C.0118.2.5.C.01 No remembered or auto-joined wireless networks
new-zealand-information-security-manual-nzism::18.2.5.C.0218.2.5.C.02 Disable wireless auto-connect on fixed-network devices
new-zealand-information-security-manual-nzism::18.2.6.C.0118.2.6.C.01 Separate public-access wireless from agency networks
new-zealand-information-security-manual-nzism::18.2.7.C.0118.2.7.C.01 GCSB approval before using wireless at TOP SECRET
new-zealand-information-security-manual-nzism::18.2.8.C.0118.2.8.C.01 Wi-Fi Alliance certified access points
new-zealand-information-security-manual-nzism::18.2.9.C.0118.2.9.C.01 EAP-TLS mutual authentication for classified wireless
new-zealand-information-security-manual-nzism::18.2.9.C.0218.2.9.C.02 Approved EAP methods for wireless mutual authentication
new-zealand-information-security-manual-nzism::18.3.10.C.0118.3.10.C.01 Establish VTC and IPT using secure protocols only
new-zealand-information-security-manual-nzism::18.3.11.C.0118.3.11.C.01 Separate or segregate VTC and IPT traffic on classified networks
new-zealand-information-security-manual-nzism::18.3.11.C.0218.3.11.C.02 Separate or segregate IPT from data traffic
new-zealand-information-security-manual-nzism::18.3.12.C.0118.3.12.C.01 Secure VTC and VoIP device setup on classified networks
new-zealand-information-security-manual-nzism::18.3.12.C.0218.3.12.C.02 Secure VoIP phone setup
new-zealand-information-security-manual-nzism::18.3.13.C.0118.3.13.C.01 Authenticate and authorise all IPT network actions
new-zealand-information-security-manual-nzism::18.3.13.C.0218.3.13.C.02 Encrypted non-replayable mutual authentication for calls
new-zealand-information-security-manual-nzism::18.3.13.C.0318.3.13.C.03 Enforce authentication for phone registration and changes
new-zealand-information-security-manual-nzism::18.3.14.C.0118.3.14.C.01 Workstation to VTC/IPT connections only with VLAN separation (classified)
new-zealand-information-security-manual-nzism::18.3.14.C.0218.3.14.C.02 Avoid workstation to VTC/IPT connections without VLAN separation
new-zealand-information-security-manual-nzism::18.3.15.C.0118.3.15.C.01 Restrict VoIP phones in lobbies and shared areas
new-zealand-information-security-manual-nzism::18.3.15.C.0218.3.15.C.02 Prefer analogue phones in lobbies and shared areas
new-zealand-information-security-manual-nzism::18.3.16.C.0118.3.16.C.01 Dedicated NICs for softphone and webcam traffic
new-zealand-information-security-manual-nzism::18.3.16.C.0218.3.16.C.02 Host firewall limiting ports on softphone and webcam workstations
new-zealand-information-security-manual-nzism::18.3.16.C.0318.3.16.C.03 Avoid softphones and webcams on classified systems
new-zealand-information-security-manual-nzism::18.3.17.C.0118.3.17.C.01 USB port control by vendor and product ID for softphone devices
new-zealand-information-security-manual-nzism::18.3.18.C.0118.3.18.C.01 Denial of service response plan for VTC and IPT
new-zealand-information-security-manual-nzism::18.3.19.C.0118.3.19.C.01 Monitoring sources and resilience measures in the DoS plan
new-zealand-information-security-manual-nzism::18.3.8.C.0118.3.8.C.01 Voice and video aware firewalls at normal firewall assurance
new-zealand-information-security-manual-nzism::18.3.9.C.0118.3.9.C.01 Encrypt VTC and IPT signalling and media
new-zealand-information-security-manual-nzism::18.3.9.C.0218.3.9.C.02 Encrypted non-replayable mutual call authentication (signalling)
new-zealand-information-security-manual-nzism::18.4.10.C.0118.4.10.C.01 Malicious code policies and procedures
new-zealand-information-security-manual-nzism::18.4.11.C.0118.4.11.C.01 Log and alert on flows breaching firewall rules
new-zealand-information-security-manual-nzism::18.4.11.C.0218.4.11.C.02 Test IDS/IPS rule sets before deployment
new-zealand-information-security-manual-nzism::18.4.11.C.0318.4.11.C.03 Alert on traffic to firewall-blocked port ranges
new-zealand-information-security-manual-nzism::18.4.12.C.0118.4.12.C.01 Security event management and cross-network correlation tools
new-zealand-information-security-manual-nzism::18.4.13.C.0118.4.13.C.01 Host-based IDS/IPS on high value servers
new-zealand-information-security-manual-nzism::18.4.14.C.0118.4.14.C.01 Block unwanted active content and restrict to trusted sources
new-zealand-information-security-manual-nzism::18.4.7.C.0118.4.7.C.01 Intrusion detection strategy for classified systems
new-zealand-information-security-manual-nzism::18.4.7.C.0218.4.7.C.02 Intrusion detection strategy
new-zealand-information-security-manual-nzism::18.4.7.C.0318.4.7.C.03 Resource IDS/IPS maintenance and monitoring
new-zealand-information-security-manual-nzism::18.4.8.C.0118.4.8.C.01 IDS/IPS at gateways to public or BYOD wireless networks
new-zealand-information-security-manual-nzism::18.4.8.C.0218.4.8.C.02 IDS/IPS at gateways to networks the agency does not manage
new-zealand-information-security-manual-nzism::18.4.8.C.0318.4.8.C.03 Place IDS/IPS just inside the outermost firewall
new-zealand-information-security-manual-nzism::18.4.9.C.0118.4.9.C.01 IDS/IPS that detect unusual and suspicious activity
new-zealand-information-security-manual-nzism::18.4.9.C.0218.4.9.C.02 Current signatures and patches for signature-based IDS
new-zealand-information-security-manual-nzism::18.5.10.C.0118.5.10.C.01 Block IPv6 tunnelling at external boundaries
new-zealand-information-security-manual-nzism::18.5.10.C.0218.5.10.C.02 Reaccreditation for dormant IPv6 gateway equipment
new-zealand-information-security-manual-nzism::18.5.11.C.0118.5.11.C.01 Reaccredit gateways when enabling dual stack or IPv6
new-zealand-information-security-manual-nzism::18.5.7.C.0118.5.7.C.01 Disable unused IPv6 on dual-stack equipment
new-zealand-information-security-manual-nzism::18.5.7.C.0218.5.7.C.02 IPv6 capable security devices on IPv6 networks
new-zealand-information-security-manual-nzism::18.5.8.C.0118.5.8.C.01 Risk assessment for dual stack or IPv6 transition
new-zealand-information-security-manual-nzism::18.5.8.C.0218.5.8.C.02 Re-accredit networks when adopting dual stack or IPv6
new-zealand-information-security-manual-nzism::18.5.8.C.0318.5.8.C.03 Disable IPv6 tunnelling unless required
new-zealand-information-security-manual-nzism::18.5.8.C.0418.5.8.C.04 Stateful DHCPv6 with centrally logged leases
new-zealand-information-security-manual-nzism::18.5.9.C.0118.5.9.C.01 Network defences must be IPv6 aware
new-zealand-information-security-manual-nzism::18.5.9.C.0218.5.9.C.02 New network devices must be IPv6 capable
new-zealand-information-security-manual-nzism::18.5.9.C.0318.5.9.C.03 Consider DNSSEC
new-zealand-information-security-manual-nzism::18.6.10.C.0118.6.10.C.01 Cross-connect domains only via approved KVM, gateway or CDS
new-zealand-information-security-manual-nzism::18.6.8.C.0118.6.8.C.01 Evaluated peripheral switch assurance by classification pair
new-zealand-information-security-manual-nzism::18.6.9.C.0118.6.9.C.01 EAL2 or PP switch between NZEO and non-NZEO systems
new-zealand-information-security-manual-nzism::18.7.14.C.0118.7.14.C.01 Threat and risk assessment before enabling inverse split tunnelling
new-zealand-information-security-manual-nzism::18.7.14.C.0218.7.14.C.02 Questions to answer in the inverse split tunnel assessment

Chapter 19: Gateway security – New Zealand Information Security Manual (NZISM)

83 controls
Controls in the Chapter 19: Gateway security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 83 controls
CodeTitle
new-zealand-information-security-manual-nzism::19.1.10.C.0119.1.10.C.01 Cascaded gateway chains meet end-to-end assurance levels
new-zealand-information-security-manual-nzism::19.1.11.C.0119.1.11.C.01 Gateways protect, filter and are physically secured
new-zealand-information-security-manual-nzism::19.1.11.C.0219.1.11.C.02 Shared gateway components managed by highest domain owner
new-zealand-information-security-manual-nzism::19.1.12.C.0119.1.12.C.01 Gateway configuration: sole path, default deny, isolated management
new-zealand-information-security-manual-nzism::19.1.13.C.0119.1.13.C.01 Operating gateways between different security domains
new-zealand-information-security-manual-nzism::19.1.14.C.0119.1.14.C.01 Use demilitarised zones for externally accessed systems
new-zealand-information-security-manual-nzism::19.1.14.C.0219.1.14.C.02 Host externally accessed systems in demilitarised zones
new-zealand-information-security-manual-nzism::19.1.15.C.0119.1.15.C.01 Risk assessment before gateway implementation
new-zealand-information-security-manual-nzism::19.1.16.C.0119.1.16.C.01 Connected owners accept residual gateway risk
new-zealand-information-security-manual-nzism::19.1.16.C.0219.1.16.C.02 Annual review of gateway architecture and connected risks
new-zealand-information-security-manual-nzism::19.1.17.C.0119.1.17.C.01 Domain owners are stakeholders of connected domains
new-zealand-information-security-manual-nzism::19.1.17.C.0219.1.17.C.02 Treat connected domain owners as information stakeholders
new-zealand-information-security-manual-nzism::19.1.18.C.0119.1.18.C.01 Gateway security training before user access
new-zealand-information-security-manual-nzism::19.1.18.C.0219.1.18.C.02 Train users on gateway risks before access
new-zealand-information-security-manual-nzism::19.1.19.C.0119.1.19.C.01 Restrict access to gateway administration
new-zealand-information-security-manual-nzism::19.1.19.C.0219.1.19.C.02 Formal training for gateway administrators
new-zealand-information-security-manual-nzism::19.1.19.C.0319.1.19.C.03 NZEO gateway administrators meet nationality requirements
new-zealand-information-security-manual-nzism::19.1.19.C.0419.1.19.C.04 Separate administrative roles for gateways
new-zealand-information-security-manual-nzism::19.1.19.C.0519.1.19.C.05 Split gateway administration into distinct roles
new-zealand-information-security-manual-nzism::19.1.20.C.0119.1.20.C.01 Authenticate users to classified networks via gateways
new-zealand-information-security-manual-nzism::19.1.20.C.0219.1.20.C.02 Only authenticated and authorised users use gateways
new-zealand-information-security-manual-nzism::19.1.20.C.0319.1.20.C.03 Multi-factor authentication for networks and gateways
new-zealand-information-security-manual-nzism::19.1.21.C.0119.1.21.C.01 Authenticate IT equipment connecting behind gateways
new-zealand-information-security-manual-nzism::19.1.22.C.0119.1.22.C.01 Risk assessment and SRMP update before gateway changes
new-zealand-information-security-manual-nzism::19.1.22.C.0219.1.22.C.02 Document gateway changes under change management policy
new-zealand-information-security-manual-nzism::19.1.22.C.0319.1.22.C.03 Assess risk and update SRMP before gateway changes
new-zealand-information-security-manual-nzism::19.1.23.C.0119.1.23.C.01 Random gateway security testing at most six months apart
new-zealand-information-security-manual-nzism::19.2.15.C.0119.2.15.C.01 Classify a CDS at highest connected domain
new-zealand-information-security-manual-nzism::19.2.16.C.0119.2.16.C.01 Cross domain solution required for classified network connections
new-zealand-information-security-manual-nzism::19.2.16.C.0219.2.16.C.02 Prohibited direct downward data flows between networks
new-zealand-information-security-manual-nzism::19.2.17.C.0119.2.17.C.01 Consult the GCSB when designing a CDS
new-zealand-information-security-manual-nzism::19.2.17.C.0219.2.17.C.02 Consult GCSB when gateway and CDS share a network
new-zealand-information-security-manual-nzism::19.2.18.C.0119.2.18.C.01 Separate diode-based upward and downward paths
new-zealand-information-security-manual-nzism::19.2.19.C.0119.2.19.C.01 Criteria for CDS trusted sources
new-zealand-information-security-manual-nzism::19.2.19.C.0219.2.19.C.02 Trusted sources authorise all exported data
new-zealand-information-security-manual-nzism::19.2.20.C.0119.2.20.C.01 Log all data exported from a security domain
new-zealand-information-security-manual-nzism::19.3.8.C.0119.3.8.C.01 Every gateway includes a firewall
new-zealand-information-security-manual-nzism::19.3.8.C.0219.3.8.C.02 Verify firewall evaluation covered security enforcing functions
new-zealand-information-security-manual-nzism::19.3.8.C.0319.3.8.C.03 Firewall assurance levels by connected network classification
new-zealand-information-security-manual-nzism::19.3.8.C.0419.3.8.C.04 Each party implements its own independent firewall
new-zealand-information-security-manual-nzism::19.3.9.C.0119.3.9.C.01 EAL4 firewall between NZEO and foreign networks
new-zealand-information-security-manual-nzism::19.3.9.C.0219.3.9.C.02 Firewall table applies to other NZEO connections
new-zealand-information-security-manual-nzism::19.3.9.C.0319.3.9.C.03 EAL2 or PP firewall for domestic NZEO connections
new-zealand-information-security-manual-nzism::19.4.4.C.0119.4.4.C.01 Diode assurance levels for one-way gateways
new-zealand-information-security-manual-nzism::19.4.5.C.0119.4.5.C.01 EAL4 diode between NZEO and foreign networks
new-zealand-information-security-manual-nzism::19.4.5.C.0219.4.5.C.02 Diode table applies to other NZEO connections
new-zealand-information-security-manual-nzism::19.4.5.C.0319.4.5.C.03 EAL2 or PP diode for domestic NZEO connections
new-zealand-information-security-manual-nzism::19.4.6.C.0119.4.6.C.01 Monitor data volume through diodes
new-zealand-information-security-manual-nzism::19.5.24.C.0119.5.24.C.01 Comprehensive risk assessment before VoIP or UC adoption
new-zealand-information-security-manual-nzism::19.5.24.C.0219.5.24.C.02 Consider availability risks in VoIP and UC design
new-zealand-information-security-manual-nzism::19.5.24.C.0319.5.24.C.03 Accreditation Authority accepts VoIP and UC risks
new-zealand-information-security-manual-nzism::19.5.24.C.0419.5.24.C.04 Assign control responsibilities across VoIP trust boundaries
new-zealand-information-security-manual-nzism::19.5.24.C.0519.5.24.C.05 VoIP and UC contracts set service and recovery terms
new-zealand-information-security-manual-nzism::19.5.24.C.0619.5.24.C.06 Contracts cover provider merger, acquisition or failure
new-zealand-information-security-manual-nzism::19.5.24.C.0719.5.24.C.07 Multi-agency agreement on shared VoIP and UC risks
new-zealand-information-security-manual-nzism::19.5.24.C.0819.5.24.C.08 Use testing tools in VoIP and UC risk assessment
new-zealand-information-security-manual-nzism::19.5.25.C.0119.5.25.C.01 Apply Chapter 19 gateway rules to non-agency networks
new-zealand-information-security-manual-nzism::19.5.26.C.0119.5.26.C.01 Define trust boundaries before VoIP or UC implementation
new-zealand-information-security-manual-nzism::19.5.26.C.0219.5.26.C.02 Verify SBC updates are genuine and unaltered
new-zealand-information-security-manual-nzism::19.5.26.C.0319.5.26.C.03 Defend against common VoIP and UC threats
new-zealand-information-security-manual-nzism::19.5.26.C.0419.5.26.C.04 SBC provides topology hiding
new-zealand-information-security-manual-nzism::19.5.26.C.0519.5.26.C.05 Consider call diversity and failover configurations
new-zealand-information-security-manual-nzism::19.5.26.C.0619.5.26.C.06 Clear data when virtual resources are reallocated
new-zealand-information-security-manual-nzism::19.5.26.C.0719.5.26.C.07 Traffic analysis for VoIP and UC capacity
new-zealand-information-security-manual-nzism::19.5.26.C.0819.5.26.C.08 Segregate UC traffic from ordinary data traffic
new-zealand-information-security-manual-nzism::19.5.26.C.0919.5.26.C.09 Separate VLANs for UC in virtualised environments
new-zealand-information-security-manual-nzism::19.5.26.C.1019.5.26.C.10 Separate LANs for UC in non-virtualised environments
new-zealand-information-security-manual-nzism::19.5.26.C.1119.5.26.C.11 Encrypt internal VoIP and UC traffic
new-zealand-information-security-manual-nzism::19.5.26.C.1219.5.26.C.12 VoIP-aware intrusion prevention and firewalls
new-zealand-information-security-manual-nzism::19.5.27.C.0119.5.27.C.01 Shared facilities identifiable physically and logically
new-zealand-information-security-manual-nzism::19.5.27.C.0219.5.27.C.02 Protected, logged administration channel
new-zealand-information-security-manual-nzism::19.5.27.C.0319.5.27.C.03 SBC administration only via trusted LAN
new-zealand-information-security-manual-nzism::19.5.27.C.0419.5.27.C.04 Access control and password rules for VoIP and UC
new-zealand-information-security-manual-nzism::19.5.27.C.0519.5.27.C.05 Compensating controls where individual credentials are impractical
new-zealand-information-security-manual-nzism::19.5.27.C.0619.5.27.C.06 Keep VoIP and UC event logs per NZISM
new-zealand-information-security-manual-nzism::19.5.28.C.0119.5.28.C.01 Incident management in service provider contracts
new-zealand-information-security-manual-nzism::19.5.28.C.0219.5.28.C.02 VoIP and UC incident identification and management
new-zealand-information-security-manual-nzism::19.5.28.C.0319.5.28.C.03 Fraud detection monitoring with alerting
new-zealand-information-security-manual-nzism::19.5.28.C.0419.5.28.C.04 Review call detail records for service theft
new-zealand-information-security-manual-nzism::19.5.28.C.0519.5.28.C.05 Allow and deny lists for fraudulent call destinations
new-zealand-information-security-manual-nzism::19.5.28.C.0619.5.28.C.06 Call rate limiting against fraud
new-zealand-information-security-manual-nzism::19.5.28.C.0719.5.28.C.07 Call redirection for blocked calls
new-zealand-information-security-manual-nzism::19.5.29.C.0119.5.29.C.01 User awareness training for VoIP and UC

Chapter 1: About information security – New Zealand Information Security Manual (NZISM)

10 controls
Controls in the Chapter 1: About information security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 10 controls
CodeTitle
new-zealand-information-security-manual-nzism::1.1.64.C.011.1.64.C.01 Dispensations for baseline non-compliance granted by Accreditation Authority
new-zealand-information-security-manual-nzism::1.1.65.C.011.1.65.C.01 Risk assessment supporting a non-compliance dispensation
new-zealand-information-security-manual-nzism::1.1.66.C.011.1.66.C.01 Consult originating agency before classification non-compliance
new-zealand-information-security-manual-nzism::1.1.66.C.021.1.66.C.02 Consult foreign government before NZISM non-compliance
new-zealand-information-security-manual-nzism::1.1.67.C.011.1.67.C.01 Formal consultation for shared and All-of-Government systems
new-zealand-information-security-manual-nzism::1.1.68.C.011.1.68.C.01 Annual review of non-compliance decisions
new-zealand-information-security-manual-nzism::1.1.69.C.011.1.69.C.01 Retain records of non-compliance decisions and assessments
new-zealand-information-security-manual-nzism::1.1.69.C.021.1.69.C.02 Recording residual risk from unimplemented recommended controls
new-zealand-information-security-manual-nzism::1.2.15.C.011.2.15.C.01 Use current NZISM version for system design
new-zealand-information-security-manual-nzism::1.2.15.C.021.2.15.C.02 Comply with GCSB-designated priority NZISM requirements

Chapter 20: Data management – New Zealand Information Security Manual (NZISM)

59 controls
Controls in the Chapter 20: Data management – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 59 controls
CodeTitle
new-zealand-information-security-manual-nzism::20.1.10.C.0120.1.10.C.01 Scan imported data for malicious content
new-zealand-information-security-manual-nzism::20.1.10.C.0220.1.10.C.02 Import controls for classified systems
new-zealand-information-security-manual-nzism::20.1.11.C.0120.1.11.C.01 Export controls for highly formatted textual data
new-zealand-information-security-manual-nzism::20.1.12.C.0120.1.12.C.01 Export controls for other data
new-zealand-information-security-manual-nzism::20.1.13.C.0120.1.13.C.01 Prevent export of NZEO data to foreign systems
new-zealand-information-security-manual-nzism::20.1.6.C.0120.1.6.C.01 Data transfer policy and staff training
new-zealand-information-security-manual-nzism::20.1.6.C.0220.1.6.C.02 Users accountable for data they transfer
new-zealand-information-security-manual-nzism::20.1.7.C.0120.1.7.C.01 Transfers follow approved procedures
new-zealand-information-security-manual-nzism::20.1.7.C.0220.1.7.C.02 Follow approved data transfer procedures
new-zealand-information-security-manual-nzism::20.1.8.C.0120.1.8.C.01 Trusted source approval for downward transfers
new-zealand-information-security-manual-nzism::20.1.9.C.0120.1.9.C.01 Criteria for data transfer trusted sources
new-zealand-information-security-manual-nzism::20.2.10.C.0120.2.10.C.01 Purpose-built NZEO data filtering
new-zealand-information-security-manual-nzism::20.2.10.C.0220.2.10.C.02 Marking and keyword checks before export
new-zealand-information-security-manual-nzism::20.2.11.C.0120.2.11.C.01 Trusted source signs data sent over untrusted networks
new-zealand-information-security-manual-nzism::20.2.11.C.0220.2.11.C.02 Gateway verifies release authority before export
new-zealand-information-security-manual-nzism::20.2.11.C.0320.2.11.C.03 EAL4 product for data signing
new-zealand-information-security-manual-nzism::20.2.3.C.0120.2.3.C.01 Accountability for data moved in or out
new-zealand-information-security-manual-nzism::20.2.4.C.0120.2.4.C.01 Trusted source approves transfers to lower systems
new-zealand-information-security-manual-nzism::20.2.5.C.0120.2.5.C.01 Trusted source list for import and export
new-zealand-information-security-manual-nzism::20.2.6.C.0120.2.6.C.01 Filter gateway imports with a purpose-built product
new-zealand-information-security-manual-nzism::20.2.6.C.0220.2.6.C.02 Monthly audit of gateway import event logs
new-zealand-information-security-manual-nzism::20.2.6.C.0320.2.6.C.03 Convert gateway imports to an alternative format
new-zealand-information-security-manual-nzism::20.2.7.C.0120.2.7.C.01 Protective marking checks on downward exports
new-zealand-information-security-manual-nzism::20.2.8.C.0120.2.8.C.01 Gateway export controls for formatted textual data
new-zealand-information-security-manual-nzism::20.2.9.C.0120.2.9.C.01 Purpose-built filtering for other gateway exports
new-zealand-information-security-manual-nzism::20.2.9.C.0220.2.9.C.02 Weekly random log audits when monthly audits lapse
new-zealand-information-security-manual-nzism::20.2.9.C.0320.2.9.C.03 Human review where classification cannot be automated
new-zealand-information-security-manual-nzism::20.2.9.C.0420.2.9.C.04 Monthly audit of complete export transfer logs
new-zealand-information-security-manual-nzism::20.3.10.C.0120.3.10.C.01 Multi-engine antivirus scanning of content
new-zealand-information-security-manual-nzism::20.3.11.C.0120.3.11.C.01 Extract archive contents for content filtering
new-zealand-information-security-manual-nzism::20.3.11.C.0220.3.11.C.02 Controlled archive inspection protects filter performance
new-zealand-information-security-manual-nzism::20.3.11.C.0320.3.11.C.03 Block uninspectable files and raise alerts
new-zealand-information-security-manual-nzism::20.3.12.C.0120.3.12.C.01 Enforce an allow list of content types
new-zealand-information-security-manual-nzism::20.3.12.C.0220.3.12.C.02 Maintain an allow list of permitted content
new-zealand-information-security-manual-nzism::20.3.13.C.0120.3.13.C.01 Validate signatures before data export
new-zealand-information-security-manual-nzism::20.3.13.C.0220.3.13.C.02 Verify content integrity and block failures
new-zealand-information-security-manual-nzism::20.3.14.C.0120.3.14.C.01 Decrypt encrypted content for filtering
new-zealand-information-security-manual-nzism::20.3.15.C.0120.3.15.C.01 Protective marking checks on domain exports
new-zealand-information-security-manual-nzism::20.3.15.C.0220.3.15.C.02 Monthly audit of complete import transfer logs
new-zealand-information-security-manual-nzism::20.3.16.C.0120.3.16.C.01 Exception process for blocked file types
new-zealand-information-security-manual-nzism::20.3.4.C.0120.3.4.C.01 Restrict transferable file types
new-zealand-information-security-manual-nzism::20.3.4.C.0220.3.4.C.02 Define and limit transferable file types
new-zealand-information-security-manual-nzism::20.3.5.C.0120.3.5.C.01 Block executables and active content entering a domain
new-zealand-information-security-manual-nzism::20.3.5.C.0220.3.5.C.02 Block executables and active content at gateways
new-zealand-information-security-manual-nzism::20.3.6.C.0120.3.6.C.01 Quarantine suspicious data pending independent review
new-zealand-information-security-manual-nzism::20.3.7.C.0120.3.7.C.01 Validate filtered content and block failures
new-zealand-information-security-manual-nzism::20.3.7.C.0220.3.7.C.02 Content filter validation with blocking
new-zealand-information-security-manual-nzism::20.3.8.C.0120.3.8.C.01 Convert content crossing domain boundaries
new-zealand-information-security-manual-nzism::20.3.9.C.0120.3.9.C.01 Sanitise content where conversion is unsuitable
new-zealand-information-security-manual-nzism::20.4.3.C.0120.4.3.C.01 Protective markings on database information
new-zealand-information-security-manual-nzism::20.4.3.C.0220.4.3.C.02 Granular protective markings in databases
new-zealand-information-security-manual-nzism::20.4.3.C.0320.4.3.C.03 Mark database information that may leave or mixes levels
new-zealand-information-security-manual-nzism::20.4.3.C.0420.4.3.C.04 Sufficiently granular database markings
new-zealand-information-security-manual-nzism::20.4.4.C.0120.4.4.C.01 Prevent database file access that bypasses controls
new-zealand-information-security-manual-nzism::20.4.4.C.0220.4.4.C.02 Protect database files from control bypass
new-zealand-information-security-manual-nzism::20.4.5.C.0120.4.5.C.01 Log and audit database user actions
new-zealand-information-security-manual-nzism::20.4.5.C.0220.4.5.C.02 Databases support auditing of user actions
new-zealand-information-security-manual-nzism::20.4.6.C.0120.4.6.C.01 Sanitise query results when filtering is unavailable
new-zealand-information-security-manual-nzism::20.4.6.C.0220.4.6.C.02 Hide search metadata from under-cleared users

Chapter 21: Distributed Working – New Zealand Information Security Manual (NZISM)

96 controls
Controls in the Chapter 21: Distributed Working – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 96 controls
CodeTitle
new-zealand-information-security-manual-nzism::21.1.10.C.0121.1.10.C.01 Policy for mobile device use
new-zealand-information-security-manual-nzism::21.1.10.C.0221.1.10.C.02 No TOP SECRET on mobile devices without GCSB approval
new-zealand-information-security-manual-nzism::21.1.10.C.0321.1.10.C.03 Deploy a Mobile Device Management solution
new-zealand-information-security-manual-nzism::21.1.11.C.0121.1.11.C.01 Tell staff the classification limits for mobile use
new-zealand-information-security-manual-nzism::21.1.11.C.0221.1.11.C.02 Avoid paging, SMS and MMS for sensitive traffic
new-zealand-information-security-manual-nzism::21.1.12.C.0121.1.12.C.01 Apply BYOD controls to non-agency devices
new-zealand-information-security-manual-nzism::21.1.13.C.0121.1.13.C.01 Handle unencrypted-to-lower devices as classified assets
new-zealand-information-security-manual-nzism::21.1.13.C.0221.1.13.C.02 Keep encryption access codes away from the device
new-zealand-information-security-manual-nzism::21.1.13.C.0321.1.13.C.03 Treat devices as classified when encryption falls short
new-zealand-information-security-manual-nzism::21.1.13.C.0421.1.13.C.04 Encrypt classified data on mobile devices
new-zealand-information-security-manual-nzism::21.1.13.C.0521.1.13.C.05 Unique access codes for each reissue of shared devices
new-zealand-information-security-manual-nzism::21.1.14.C.0121.1.14.C.01 Encrypt mobile traffic over untrusted networks
new-zealand-information-security-manual-nzism::21.1.14.C.0221.1.14.C.02 Encrypt official information in mobile communications
new-zealand-information-security-manual-nzism::21.1.15.C.0121.1.15.C.01 Privacy filters on mobile device screens
new-zealand-information-security-manual-nzism::21.1.16.C.0121.1.16.C.01 Bluetooth disabled on higher-classification mobile devices
new-zealand-information-security-manual-nzism::21.1.16.C.0221.1.16.C.02 Keep Bluetooth off on mobile devices
new-zealand-information-security-manual-nzism::21.1.17.C.0121.1.17.C.01 No disabling of security settings after provisioning
new-zealand-information-security-manual-nzism::21.1.17.C.0221.1.17.C.02 Manage mobile configuration like office devices
new-zealand-information-security-manual-nzism::21.1.17.C.0321.1.17.C.03 Block unauthorised app installs on devices
new-zealand-information-security-manual-nzism::21.1.18.C.0121.1.18.C.01 Regular patching and security testing of mobiles
new-zealand-information-security-manual-nzism::21.1.18.C.0221.1.18.C.02 Policy compliance checks on mobile connection
new-zealand-information-security-manual-nzism::21.1.19.C.0121.1.19.C.01 Split tunnelling disabled on mobile VPN
new-zealand-information-security-manual-nzism::21.1.19.C.0221.1.19.C.02 Mobile Internet access only to establish VPN
new-zealand-information-security-manual-nzism::21.1.20.C.0121.1.20.C.01 Emergency destruction plan for mobiles
new-zealand-information-security-manual-nzism::21.1.20.C.0221.1.20.C.02 Use key zeroise functions in emergency destruction
new-zealand-information-security-manual-nzism::21.1.20.C.0321.1.20.C.03 Train staff on emergency destruction
new-zealand-information-security-manual-nzism::21.1.21.C.0121.1.21.C.01 Soft labelling to lower device attractiveness
new-zealand-information-security-manual-nzism::21.1.22.C.0121.1.22.C.01 Policy on personal use of agency devices
new-zealand-information-security-manual-nzism::21.1.22.C.0221.1.22.C.02 Only authorised personnel use mobile devices
new-zealand-information-security-manual-nzism::21.2.4.C.0121.2.4.C.01 Classified mobile work outside secure areas
new-zealand-information-security-manual-nzism::21.2.4.C.0221.2.4.C.02 Avoid classified work in public places
new-zealand-information-security-manual-nzism::21.2.5.C.0121.2.5.C.01 Carry mobile devices in a secured state
new-zealand-information-security-manual-nzism::21.2.6.C.0121.2.6.C.01 Continuous supervision of devices in use
new-zealand-information-security-manual-nzism::21.2.7.C.0121.2.7.C.01 Keep control of devices and media when travelling
new-zealand-information-security-manual-nzism::21.2.7.C.0221.2.7.C.02 Report border inspection of devices to an ITSM
new-zealand-information-security-manual-nzism::21.3.5.C.0121.3.5.C.01 Secure idle devices at home per the PSR
new-zealand-information-security-manual-nzism::21.3.6.C.0121.3.6.C.01 Home work area meets PSR minimums
new-zealand-information-security-manual-nzism::21.4.10.C.0121.4.10.C.01 Implement risk-based extra BYOD controls first
new-zealand-information-security-manual-nzism::21.4.10.C.0221.4.10.C.02 Signed BYOD acceptable use policy
new-zealand-information-security-manual-nzism::21.4.10.C.0321.4.10.C.03 Define eligibility for the BYOD scheme
new-zealand-information-security-manual-nzism::21.4.10.C.0421.4.10.C.04 Written authorisation before BYOD onboarding
new-zealand-information-security-manual-nzism::21.4.10.C.0521.4.10.C.05 Scope of access in BYOD authorisations
new-zealand-information-security-manual-nzism::21.4.10.C.0621.4.10.C.06 Offboarding removal of agency software and data
new-zealand-information-security-manual-nzism::21.4.10.C.0721.4.10.C.07 BYOD network operating procedures
new-zealand-information-security-manual-nzism::21.4.10.C.0821.4.10.C.08 Provision for contractors in BYOD
new-zealand-information-security-manual-nzism::21.4.10.C.0921.4.10.C.09 Agreed ownership of data on BYOD
new-zealand-information-security-manual-nzism::21.4.10.C.1021.4.10.C.10 Split of support responsibilities for BYOD
new-zealand-information-security-manual-nzism::21.4.10.C.1121.4.10.C.11 Rules on GPS and tracking capability
new-zealand-information-security-manual-nzism::21.4.10.C.1221.4.10.C.12 Agree who pays for BYOD devices
new-zealand-information-security-manual-nzism::21.4.10.C.1321.4.10.C.13 Agree replacement after loss or theft
new-zealand-information-security-manual-nzism::21.4.10.C.1421.4.10.C.14 User duty for firewall, anti-malware and patching
new-zealand-information-security-manual-nzism::21.4.10.C.1521.4.10.C.15 Procedures for business app purchase and install
new-zealand-information-security-manual-nzism::21.4.10.C.1621.4.10.C.16 Agree responsibility for voice, data and roaming costs
new-zealand-information-security-manual-nzism::21.4.11.C.0121.4.11.C.01 Security architecture review before BYOD connects
new-zealand-information-security-manual-nzism::21.4.11.C.0221.4.11.C.02 Segregate the BYOD network segment
new-zealand-information-security-manual-nzism::21.4.11.C.0321.4.11.C.03 Separate guest networks from BYOD networks
new-zealand-information-security-manual-nzism::21.4.11.C.0421.4.11.C.04 Agency resources reachable only via BYOD segment
new-zealand-information-security-manual-nzism::21.4.11.C.0521.4.11.C.05 Limit BYOD access to authorised business services
new-zealand-information-security-manual-nzism::21.4.11.C.0621.4.11.C.06 Secure wireless access points per Section 18.2
new-zealand-information-security-manual-nzism::21.4.11.C.0721.4.11.C.07 Bluetooth off for BYOD in secure areas
new-zealand-information-security-manual-nzism::21.4.11.C.0821.4.11.C.08 BYOD access controls per Chapter 16
new-zealand-information-security-manual-nzism::21.4.11.C.0921.4.11.C.09 List of permitted BYOD operating systems and versions
new-zealand-information-security-manual-nzism::21.4.11.C.1021.4.11.C.10 Malware check before installing agency software
new-zealand-information-security-manual-nzism::21.4.11.C.1121.4.11.C.11 Malware check before BYOD accesses agency data
new-zealand-information-security-manual-nzism::21.4.11.C.1221.4.11.C.12 Minimum MDM capabilities for BYOD
new-zealand-information-security-manual-nzism::21.4.11.C.1321.4.11.C.13 Intrusion detection for BYOD
new-zealand-information-security-manual-nzism::21.4.11.C.1421.4.11.C.14 Continuous monitoring of BYOD for compromise
new-zealand-information-security-manual-nzism::21.4.11.C.1521.4.11.C.15 List of approved cloud apps for BYOD
new-zealand-information-security-manual-nzism::21.4.11.C.1621.4.11.C.16 Block unapproved cloud apps for agency data
new-zealand-information-security-manual-nzism::21.4.11.C.1721.4.11.C.17 No direct BYOD connections to internal hosts
new-zealand-information-security-manual-nzism::21.4.11.C.1821.4.11.C.18 BYOD on guest networks reach corporate only by VPN
new-zealand-information-security-manual-nzism::21.4.11.C.1921.4.11.C.19 Bluetooth off for BYOD on premises and during access
new-zealand-information-security-manual-nzism::21.4.11.C.2021.4.11.C.20 Multi-factor authentication for BYOD access
new-zealand-information-security-manual-nzism::21.4.12.C.0121.4.12.C.01 Wireless IDS/IPS on BYOD wireless networks
new-zealand-information-security-manual-nzism::21.4.12.C.0221.4.12.C.02 Rogue AP and hot spot detection with response
new-zealand-information-security-manual-nzism::21.4.12.C.0321.4.12.C.03 Baseline survey of authorised and unauthorised APs
new-zealand-information-security-manual-nzism::21.4.13.C.0121.4.13.C.01 Encrypt agency data in transit to BYOD
new-zealand-information-security-manual-nzism::21.4.13.C.0221.4.13.C.02 Encrypt agency data stored on BYOD
new-zealand-information-security-manual-nzism::21.4.13.C.0321.4.13.C.03 Non-persistent containers for each BYOD session
new-zealand-information-security-manual-nzism::21.4.13.C.0421.4.13.C.04 Remove or encrypt sensitive data at session end
new-zealand-information-security-manual-nzism::21.4.13.C.0521.4.13.C.05 Time-limited BYOD network sessions
new-zealand-information-security-manual-nzism::21.4.13.C.0621.4.13.C.06 VPN required for BYOD communications
new-zealand-information-security-manual-nzism::21.4.13.C.0721.4.13.C.07 Disable split tunnelling for BYOD VPN
new-zealand-information-security-manual-nzism::21.4.13.C.0821.4.13.C.08 Prevent simultaneous connections on BYOD
new-zealand-information-security-manual-nzism::21.4.13.C.0921.4.13.C.09 Enforce device unlock password or PIN
new-zealand-information-security-manual-nzism::21.4.13.C.1021.4.13.C.10 Device password separate from agency credentials
new-zealand-information-security-manual-nzism::21.4.13.C.1121.4.13.C.11 BYOD passwords distinct from other agency network passwords
new-zealand-information-security-manual-nzism::21.4.14.C.0121.4.14.C.01 Publish approved BYOD devices and OS list
new-zealand-information-security-manual-nzism::21.4.14.C.0221.4.14.C.02 Consider Data Loss Prevention for BYOD
new-zealand-information-security-manual-nzism::21.4.14.C.0321.4.14.C.03 Consider bandwidth limits to control transfers
new-zealand-information-security-manual-nzism::21.4.14.C.0421.4.14.C.04 Legal advice on BYOD policy provisions
new-zealand-information-security-manual-nzism::21.4.7.C.0121.4.7.C.01 Risk assessment before allowing BYOD
new-zealand-information-security-manual-nzism::21.4.7.C.0221.4.7.C.02 Integrated approach to BYOD security
new-zealand-information-security-manual-nzism::21.4.8.C.0121.4.8.C.01 BYOD limited to RESTRICTED and below
new-zealand-information-security-manual-nzism::21.4.8.C.0221.4.8.C.02 No BYOD on CONFIDENTIAL and above
new-zealand-information-security-manual-nzism::21.4.9.C.0121.4.9.C.01 Block jail-broken or rooted devices

Chapter 22: Enterprise systems security – New Zealand Information Security Manual (NZISM)

61 controls
Controls in the Chapter 22: Enterprise systems security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 61 controls
CodeTitle
new-zealand-information-security-manual-nzism::22.1.20.C.0122.1.20.C.01 GCSB approval for classified cloud use
new-zealand-information-security-manual-nzism::22.1.20.C.0222.1.20.C.02 Cloud providers apply NZISM controls to classified agency systems
new-zealand-information-security-manual-nzism::22.1.20.C.0322.1.20.C.03 No external cloud for CONFIDENTIAL and above
new-zealand-information-security-manual-nzism::22.1.20.C.0422.1.20.C.04 No public or hybrid cloud for NZEO information
new-zealand-information-security-manual-nzism::22.1.20.C.0522.1.20.C.05 Formal provider assurance of NZISM control application
new-zealand-information-security-manual-nzism::22.1.21.C.0122.1.21.C.01 Risk assessment before cloud adoption
new-zealand-information-security-manual-nzism::22.1.21.C.0222.1.21.C.02 Define trust boundaries before cloud implementation
new-zealand-information-security-manual-nzism::22.1.21.C.0322.1.21.C.03 Allocate control responsibilities between agency and provider
new-zealand-information-security-manual-nzism::22.1.21.C.0422.1.21.C.04 Executive and Accreditation Authority acceptance of cloud risks
new-zealand-information-security-manual-nzism::22.1.21.C.0522.1.21.C.05 Consult the GCDO on cloud risks
new-zealand-information-security-manual-nzism::22.1.21.C.0622.1.21.C.06 Multi-agency agreement on shared cloud service risks
new-zealand-information-security-manual-nzism::22.1.21.C.0722.1.21.C.07 Documented risk assessment and GCDO endorsement for cloud use
new-zealand-information-security-manual-nzism::22.1.22.C.0122.1.22.C.01 Accept jurisdiction, sovereignty and privacy risks of offshore cloud
new-zealand-information-security-manual-nzism::22.1.22.C.0222.1.22.C.02 Retain information ownership in offshore cloud contracts
new-zealand-information-security-manual-nzism::22.1.22.C.0322.1.22.C.03 Endorsement for offshore cloud linked to All-of-Government systems
new-zealand-information-security-manual-nzism::22.1.22.C.0422.1.22.C.04 No offshore cloud for classified information
new-zealand-information-security-manual-nzism::22.1.22.C.0522.1.22.C.05 No offshore cloud for NZEO information
new-zealand-information-security-manual-nzism::22.1.22.C.0622.1.22.C.06 Conditions before using offshore cloud services
new-zealand-information-security-manual-nzism::22.1.23.C.0122.1.23.C.01 Design cloud architecture for availability risks
new-zealand-information-security-manual-nzism::22.1.23.C.0222.1.23.C.02 Service level and recovery terms in cloud contracts
new-zealand-information-security-manual-nzism::22.1.23.C.0322.1.23.C.03 Contract terms for provider merger, insolvency or termination
new-zealand-information-security-manual-nzism::22.1.24.C.0122.1.24.C.01 Provider physical, virtual and access controls per NZISM
new-zealand-information-security-manual-nzism::22.1.24.C.0222.1.24.C.02 Separation and access controls for offshore support staff
new-zealand-information-security-manual-nzism::22.1.24.C.0322.1.24.C.03 Detect and block unauthorised offshore data transfers
new-zealand-information-security-manual-nzism::22.1.24.C.0422.1.24.C.04 Consider encryption in transit and at rest
new-zealand-information-security-manual-nzism::22.1.25.C.0122.1.25.C.01 Incident handling services in cloud contracts
new-zealand-information-security-manual-nzism::22.1.25.C.0222.1.25.C.02 Incident identification and management processes for cloud
new-zealand-information-security-manual-nzism::22.1.26.C.0122.1.26.C.01 Backup, recovery and archiving plan for cloud
new-zealand-information-security-manual-nzism::22.1.26.C.0222.1.26.C.02 Data purge or secure delete in cloud contracts
new-zealand-information-security-manual-nzism::22.1.26.C.0322.1.26.C.03 Independent verification of cloud data deletion
new-zealand-information-security-manual-nzism::22.1.27.C.0122.1.27.C.01 User awareness and training for cloud services
new-zealand-information-security-manual-nzism::22.2.12.C.0122.2.12.C.01 No virtualisation to separate servers of different classifications
new-zealand-information-security-manual-nzism::22.2.12.C.0222.2.12.C.02 No virtualisation between security domains at same classification (classified)
new-zealand-information-security-manual-nzism::22.2.12.C.0322.2.12.C.03 Approved ways to achieve server functional segregation
new-zealand-information-security-manual-nzism::22.2.12.C.0422.2.12.C.04 Avoid virtualisation across same-classification security domains
new-zealand-information-security-manual-nzism::22.2.13.C.0122.2.13.C.01 Virtualisation risk assessment for classified systems
new-zealand-information-security-manual-nzism::22.2.13.C.0222.2.13.C.02 Virtualisation-specific risk assessment
new-zealand-information-security-manual-nzism::22.2.14.C.0122.2.14.C.01 Trust zones or domains in classified virtual architecture
new-zealand-information-security-manual-nzism::22.2.14.C.0222.2.14.C.02 No host-guest file or component sharing (classified)
new-zealand-information-security-manual-nzism::22.2.14.C.0322.2.14.C.03 Trust zones to separate virtual system elements
new-zealand-information-security-manual-nzism::22.2.14.C.0422.2.14.C.04 Enable functional segregation within a security domain
new-zealand-information-security-manual-nzism::22.2.14.C.0522.2.14.C.05 Harden virtualisation host operating systems
new-zealand-information-security-manual-nzism::22.2.14.C.0622.2.14.C.06 Separate production from test and development virtual environments
new-zealand-information-security-manual-nzism::22.2.14.C.0722.2.14.C.07 Avoid host-guest file and component sharing
new-zealand-information-security-manual-nzism::22.2.15.C.0122.2.15.C.01 VM migration policy and SOPs (classified)
new-zealand-information-security-manual-nzism::22.2.15.C.0222.2.15.C.02 Prevent unauthorised VM migration (classified)
new-zealand-information-security-manual-nzism::22.2.15.C.0322.2.15.C.03 Safe VM decommissioning including residual data (classified)
new-zealand-information-security-manual-nzism::22.2.15.C.0422.2.15.C.04 VM migration policy and SOPs
new-zealand-information-security-manual-nzism::22.2.15.C.0522.2.15.C.05 Controls against unauthorised VM migrations
new-zealand-information-security-manual-nzism::22.2.15.C.0622.2.15.C.06 Safely decommission unneeded VMs
new-zealand-information-security-manual-nzism::22.2.15.C.0722.2.15.C.07 Minimum capabilities for virtualisation management tools
new-zealand-information-security-manual-nzism::22.2.16.C.0122.2.16.C.01 Strong physical security for virtual infrastructure
new-zealand-information-security-manual-nzism::22.2.16.C.0222.2.16.C.02 Strong authentication and access control for virtualisation
new-zealand-information-security-manual-nzism::22.2.16.C.0322.2.16.C.03 Strong data validation checks
new-zealand-information-security-manual-nzism::22.3.10.C.0122.3.10.C.01 Switch administration only from most trusted network
new-zealand-information-security-manual-nzism::22.3.11.C.0122.3.11.C.01 Disable unused switch ports (classified)
new-zealand-information-security-manual-nzism::22.3.11.C.0222.3.11.C.02 Disable unused switch ports
new-zealand-information-security-manual-nzism::22.3.9.C.0122.3.9.C.01 Separation and segregation in VLAN design
new-zealand-information-security-manual-nzism::22.3.9.C.0222.3.9.C.02 No VLANs to lower-classification networks (classified)
new-zealand-information-security-manual-nzism::22.3.9.C.0322.3.9.C.03 No VLANs between classified and unclassified networks
new-zealand-information-security-manual-nzism::22.3.9.C.0422.3.9.C.04 No VLAN trunking across differing security domains

Chapter 23: Public Cloud Security – New Zealand Information Security Manual (NZISM)

36 controls
Controls in the Chapter 23: Public Cloud Security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 36 controls
CodeTitle
new-zealand-information-security-manual-nzism::23.1.54.C.0123.1.54.C.01 Identify classification, domain and trust zone boundaries for public cloud
new-zealand-information-security-manual-nzism::23.1.54.C.0223.1.54.C.02 Separate domain when multiple identity systems control access
new-zealand-information-security-manual-nzism::23.1.55.C.0123.1.55.C.01 Understand shared security responsibilities per cloud service
new-zealand-information-security-manual-nzism::23.1.55.C.0223.1.55.C.02 Document agency and provider security responsibilities
new-zealand-information-security-manual-nzism::23.1.55.C.0323.1.55.C.03 Align security processes with provider responsibilities
new-zealand-information-security-manual-nzism::23.1.56.C.0123.1.56.C.01 Infrastructure as code for cloud management
new-zealand-information-security-manual-nzism::23.2.16.C.0123.2.16.C.01 Update risk assessment process for public cloud risks
new-zealand-information-security-manual-nzism::23.2.16.C.0223.2.16.C.02 Per-service cloud risk assessment following GCDO process
new-zealand-information-security-manual-nzism::23.2.16.C.0323.2.16.C.03 No accreditation of public cloud for classified data
new-zealand-information-security-manual-nzism::23.2.16.C.0423.2.16.C.04 No accreditation of public cloud for NZEO information
new-zealand-information-security-manual-nzism::23.2.17.C.0123.2.17.C.01 Availability risks in public cloud design
new-zealand-information-security-manual-nzism::23.2.18.C.0123.2.18.C.01 Regular qualified assurance checks of cloud providers
new-zealand-information-security-manual-nzism::23.2.19.C.0123.2.19.C.01 Assurance of provider patching and maintenance
new-zealand-information-security-manual-nzism::23.2.20.C.0123.2.20.C.01 Assurance of tenant isolation on shared infrastructure
new-zealand-information-security-manual-nzism::23.2.21.C.0123.2.21.C.01 Use GCSB endorsed baseline security templates
new-zealand-information-security-manual-nzism::23.3.18.C.0123.3.18.C.01 Do not synchronise privileged accounts across environments
new-zealand-information-security-manual-nzism::23.3.19.C.0123.3.19.C.01 MFA for privileged accounts on internet-facing admin portals
new-zealand-information-security-manual-nzism::23.3.19.C.0223.3.19.C.02 MFA for users on internet-facing cloud portals
new-zealand-information-security-manual-nzism::23.3.20.C.0123.3.20.C.01 Offboarding removes all public cloud access
new-zealand-information-security-manual-nzism::23.3.21.C.0123.3.21.C.01 Relying parties continually verify identity provider responses
new-zealand-information-security-manual-nzism::23.3.22.C.0123.3.22.C.01 Relying parties use all identity provider information
new-zealand-information-security-manual-nzism::23.4.10.C.0123.4.10.C.01 Least privilege and restricted cloud service endpoints
new-zealand-information-security-manual-nzism::23.4.11.C.0123.4.11.C.01 Identify where public cloud data is stored and processed
new-zealand-information-security-manual-nzism::23.4.11.C.0223.4.11.C.02 Data location risks in public cloud risk assessments
new-zealand-information-security-manual-nzism::23.4.12.C.0123.4.12.C.01 Update disaster recovery plans before storing data in public cloud
new-zealand-information-security-manual-nzism::23.4.12.C.0223.4.12.C.02 Test cloud-specific data recovery processes
new-zealand-information-security-manual-nzism::23.4.13.C.0123.4.13.C.01 Defined exit strategy for each public cloud service
new-zealand-information-security-manual-nzism::23.4.13.C.0223.4.13.C.02 Retrieve retained data before cloud decommissioning
new-zealand-information-security-manual-nzism::23.4.13.C.0323.4.13.C.03 Assurance no agency data remains after decommissioning
new-zealand-information-security-manual-nzism::23.4.9.C.0123.4.9.C.01 Cloud data protection mechanisms meet agency requirements
new-zealand-information-security-manual-nzism::23.4.9.C.0223.4.9.C.02 Update key management plans for public cloud
new-zealand-information-security-manual-nzism::23.4.9.C.0323.4.9.C.03 Key management plan covers data migration out of cloud
new-zealand-information-security-manual-nzism::23.5.10.C.0123.5.10.C.01 Assess sufficiency of provider logging capabilities
new-zealand-information-security-manual-nzism::23.5.11.C.0123.5.11.C.01 Collect and protect public cloud logs with integrity
new-zealand-information-security-manual-nzism::23.5.12.C.0123.5.12.C.01 Integrate provider logs into enterprise alerting
new-zealand-information-security-manual-nzism::23.5.12.C.0223.5.12.C.02 Incident detection accounts for consumed cloud services

Chapter 2: Information Security Services within Government – New Zealand Information Security Manual (NZISM)

22 controls
Controls in the Chapter 2: Information Security Services within Government – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 22 controls
CodeTitle
new-zealand-information-security-manual-nzism::2.1.49.C.012.1.49.C.01 Security staff aware of government security service providers
new-zealand-information-security-manual-nzism::2.2.5.C.012.2.5.C.01 Accredit contractor systems for outsourced IT services
new-zealand-information-security-manual-nzism::2.2.5.C.022.2.5.C.02 Avoid offshore outsourcing without security agreements
new-zealand-information-security-manual-nzism::2.2.6.C.012.2.6.C.01 ITSMs independent of outsourced IT provider
new-zealand-information-security-manual-nzism::2.2.6.C.022.2.6.C.02 Single security contact at outsourced provider
new-zealand-information-security-manual-nzism::2.2.7.C.012.2.7.C.01 Program to manage accredited IT contractors
new-zealand-information-security-manual-nzism::2.3.25.C.012.3.25.C.01 Plan for adopting public cloud services
new-zealand-information-security-manual-nzism::2.3.25.C.022.3.25.C.02 Required content of a cloud adoption plan
new-zealand-information-security-manual-nzism::2.3.26.C.012.3.26.C.01 Apply Zero Trust principles to cloud adoption
new-zealand-information-security-manual-nzism::2.3.26.C.022.3.26.C.02 Prefer cloud-native security over legacy perimeter controls
new-zealand-information-security-manual-nzism::2.3.27.C.012.3.27.C.01 Comprehensive cloud risk assessment per GCDO guidance
new-zealand-information-security-manual-nzism::2.3.27.C.022.3.27.C.02 Formal acceptance of cloud risks by executives
new-zealand-information-security-manual-nzism::2.3.28.C.012.3.28.C.01 Update security architecture for cloud adoption
new-zealand-information-security-manual-nzism::2.3.29.C.012.3.29.C.01 Consider All-of-Government cloud contracts first
new-zealand-information-security-manual-nzism::2.3.30.C.012.3.30.C.01 Safe return of data on termination
new-zealand-information-security-manual-nzism::2.4.13.C.012.4.13.C.01 Track developments in next-generation public-key cryptography
new-zealand-information-security-manual-nzism::2.4.13.C.022.4.13.C.02 Inventory long-lived sensitive datasets at harvest risk
new-zealand-information-security-manual-nzism::2.4.13.C.032.4.13.C.03 Inventory systems that use cryptographic technologies
new-zealand-information-security-manual-nzism::2.4.13.C.042.4.13.C.04 Flag public-key dependent systems in risk assessments
new-zealand-information-security-manual-nzism::2.4.13.C.052.4.13.C.05 Prioritise vulnerable systems for cryptographic transition
new-zealand-information-security-manual-nzism::2.4.13.C.062.4.13.C.06 Factors for prioritising cryptographic transition
new-zealand-information-security-manual-nzism::2.4.13.C.072.4.13.C.07 Plan system transitions to new cryptographic standard

Chapter 3: Information security governance - roles and responsibilities – New Zealand Information Security Manual (NZISM)

68 controls
Controls in the Chapter 3: Information security governance - roles and responsibilities – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 68 controls
CodeTitle
new-zealand-information-security-manual-nzism::3.1.8.C.013.1.8.C.01 Seniority of the agency head's delegate
new-zealand-information-security-manual-nzism::3.1.8.C.023.1.8.C.02 Delegate understands residual risk consequences
new-zealand-information-security-manual-nzism::3.1.8.C.033.1.8.C.03 Managing conflicts where small agencies cannot segregate duties
new-zealand-information-security-manual-nzism::3.1.9.C.013.1.9.C.01 Agency head support for information security
new-zealand-information-security-manual-nzism::3.2.10.C.013.2.10.C.01 CISO strategic security and risk program
new-zealand-information-security-manual-nzism::3.2.10.C.023.2.10.C.02 CISO owns security communications plan
new-zealand-information-security-manual-nzism::3.2.10.C.033.2.10.C.03 CISO establishes security risk management process
new-zealand-information-security-manual-nzism::3.2.10.C.043.2.10.C.04 CISO aligns system policies with PSR and NZISM
new-zealand-information-security-manual-nzism::3.2.11.C.013.2.11.C.01 CISO establishes compliance mechanisms for security policy
new-zealand-information-security-manual-nzism::3.2.11.C.023.2.11.C.02 CISO drives continuous certification and accreditation
new-zealand-information-security-manual-nzism::3.2.11.C.033.2.11.C.03 CISO implements security metrics and KPIs
new-zealand-information-security-manual-nzism::3.2.12.C.013.2.12.C.01 Information security steering committee
new-zealand-information-security-manual-nzism::3.2.12.C.023.2.12.C.02 CISO coordinates security projects across teams
new-zealand-information-security-manual-nzism::3.2.12.C.033.2.12.C.03 Consistent risk analysis and acceptable risk levels
new-zealand-information-security-manual-nzism::3.2.13.C.013.2.13.C.01 CISO strategic guidance for ICT projects
new-zealand-information-security-manual-nzism::3.2.13.C.023.2.13.C.02 Align security architecture with enterprise architecture
new-zealand-information-security-manual-nzism::3.2.14.C.013.2.14.C.01 CISO coordinates external security resources
new-zealand-information-security-manual-nzism::3.2.15.C.013.2.15.C.01 CISO controls information security budget
new-zealand-information-security-manual-nzism::3.2.16.C.013.2.16.C.01 CISO aware of all security incidents
new-zealand-information-security-manual-nzism::3.2.17.C.013.2.17.C.01 CISO coordinates disaster recovery policies
new-zealand-information-security-manual-nzism::3.2.18.C.013.2.18.C.01 CISO oversees awareness and training programs
new-zealand-information-security-manual-nzism::3.2.19.C.013.2.19.C.01 CISO provides authoritative security advice
new-zealand-information-security-manual-nzism::3.2.8.C.013.2.8.C.01 CISO clearance and compartmented briefing eligibility
new-zealand-information-security-manual-nzism::3.2.8.C.023.2.8.C.02 Appoint or assign a CISO role
new-zealand-information-security-manual-nzism::3.2.8.C.033.2.8.C.03 CISO at senior executive level
new-zealand-information-security-manual-nzism::3.2.8.C.043.2.8.C.04 CISO oversees security personnel
new-zealand-information-security-manual-nzism::3.2.8.C.053.2.8.C.05 Manage CISO conflicts from multiple roles
new-zealand-information-security-manual-nzism::3.2.9.C.013.2.9.C.01 CISO reports directly to agency head
new-zealand-information-security-manual-nzism::3.3.10.C.013.3.10.C.01 Report on technical security management
new-zealand-information-security-manual-nzism::3.3.10.C.023.3.10.C.02 Monitor and report policy compliance and enforcement
new-zealand-information-security-manual-nzism::3.3.10.C.033.3.10.C.03 Regular incident and concern reports to CISO
new-zealand-information-security-manual-nzism::3.3.10.C.043.3.10.C.04 Assess and report threats, vulnerabilities and residual risk
new-zealand-information-security-manual-nzism::3.3.11.C.013.3.11.C.01 Support response to audit failures
new-zealand-information-security-manual-nzism::3.3.12.C.013.3.12.C.01 ITSM guidance for disaster recovery planning
new-zealand-information-security-manual-nzism::3.3.13.C.013.3.13.C.01 Security awareness training for all personnel
new-zealand-information-security-manual-nzism::3.3.13.C.023.3.13.C.02 Technical materials and workshops on security
new-zealand-information-security-manual-nzism::3.3.14.C.013.3.14.C.01 Maintain a current security knowledge base
new-zealand-information-security-manual-nzism::3.3.14.C.023.3.14.C.02 Expert security guidance for ICT projects
new-zealand-information-security-manual-nzism::3.3.14.C.033.3.14.C.03 Technical advice to security and change committees
new-zealand-information-security-manual-nzism::3.3.15.C.013.3.15.C.01 ITSM informs CISO and owners of threats
new-zealand-information-security-manual-nzism::3.3.4.C.013.3.4.C.01 Appoint at least one ITSM
new-zealand-information-security-manual-nzism::3.3.4.C.023.3.4.C.02 ITSM clearance and compartmented briefing eligibility
new-zealand-information-security-manual-nzism::3.3.4.C.033.3.4.C.03 Local ITSM at each major site
new-zealand-information-security-manual-nzism::3.3.4.C.043.3.4.C.04 ITSM authority and training suited to scope
new-zealand-information-security-manual-nzism::3.3.4.C.053.3.4.C.05 ITSMs without unrelated extra duties
new-zealand-information-security-manual-nzism::3.3.5.C.013.3.5.C.01 ITSM helps CISO build security program
new-zealand-information-security-manual-nzism::3.3.5.C.023.3.5.C.02 ITSM manages projects addressing security risks
new-zealand-information-security-manual-nzism::3.3.6.C.013.3.6.C.01 ITSM assists system owners with accreditation
new-zealand-information-security-manual-nzism::3.3.6.C.023.3.6.C.02 ITSM identifies systems needing security measures
new-zealand-information-security-manual-nzism::3.3.6.C.033.3.6.C.03 Security in IT equipment and software lifecycle
new-zealand-information-security-manual-nzism::3.3.6.C.043.3.6.C.04 Integrate risk assessment into system architectures
new-zealand-information-security-manual-nzism::3.3.6.C.053.3.6.C.05 ITSM participation in change management
new-zealand-information-security-manual-nzism::3.3.6.C.063.3.6.C.06 Notify Accreditation Authority of significant changes
new-zealand-information-security-manual-nzism::3.3.7.C.013.3.7.C.01 Security terms in vendor contracts and SLAs
new-zealand-information-security-manual-nzism::3.3.8.C.013.3.8.C.01 ITSM ensures SRMPs, SSPs and SOPs exist
new-zealand-information-security-manual-nzism::3.3.8.C.023.3.8.C.02 Risk assess new or updated IT in environment
new-zealand-information-security-manual-nzism::3.3.8.C.033.3.8.C.03 Select and coordinate controls enforcing policy
new-zealand-information-security-manual-nzism::3.3.8.C.043.3.8.C.04 Integrate security strategy with business and ICT strategy
new-zealand-information-security-manual-nzism::3.3.8.C.053.3.8.C.05 ITSM expertise for security management tools
new-zealand-information-security-manual-nzism::3.3.9.C.013.3.9.C.01 ITSM supports security budget projections
new-zealand-information-security-manual-nzism::3.4.10.C.013.4.10.C.01 Every system has an accountable owner
new-zealand-information-security-manual-nzism::3.4.10.C.023.4.10.C.02 Senior ownership of large or critical systems
new-zealand-information-security-manual-nzism::3.4.11.C.013.4.11.C.01 System owners obtain and maintain accreditation
new-zealand-information-security-manual-nzism::3.4.12.C.013.4.12.C.01 Owners maintain complete security documentation
new-zealand-information-security-manual-nzism::3.4.12.C.023.4.12.C.02 ITSM involvement in documentation updates
new-zealand-information-security-manual-nzism::3.5.4.C.013.5.4.C.01 System users comply with security policies
new-zealand-information-security-manual-nzism::3.5.4.C.023.5.4.C.02 User obligations for authenticators and account use
new-zealand-information-security-manual-nzism::3.5.4.C.033.5.4.C.03 Formal authorisation to bypass security controls

Chapter 4: System Certification and Accreditation – New Zealand Information Security Manual (NZISM)

39 controls
Controls in the Chapter 4: System Certification and Accreditation – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 39 controls
CodeTitle
new-zealand-information-security-manual-nzism::4.2.10.C.014.2.10.C.01 Audit required for certification
new-zealand-information-security-manual-nzism::4.2.11.C.014.2.11.C.01 Certification authority acceptance of control effectiveness
new-zealand-information-security-manual-nzism::4.2.12.C.014.2.12.C.01 Residual risk assessment for the Accreditation Authority
new-zealand-information-security-manual-nzism::4.3.16.C.014.3.16.C.01 Auditor independence from owner and certifier
new-zealand-information-security-manual-nzism::4.3.17.C.014.3.17.C.01 Owner approves architecture and documentation before audit
new-zealand-information-security-manual-nzism::4.3.18.C.014.3.18.C.01 Auditor reviews core security documentation set
new-zealand-information-security-manual-nzism::4.3.18.C.024.3.18.C.02 Auditor confirms SecPol addresses applicable controls
new-zealand-information-security-manual-nzism::4.3.18.C.034.3.18.C.03 Auditor reviews architecture against security principles
new-zealand-information-security-manual-nzism::4.3.18.C.044.3.18.C.04 Auditor confirms SecPol protects classified information
new-zealand-information-security-manual-nzism::4.3.18.C.054.3.18.C.05 Statement of applicability for the system
new-zealand-information-security-manual-nzism::4.3.19.C.014.3.19.C.01 Implement controls before certification testing
new-zealand-information-security-manual-nzism::4.3.20.C.014.3.20.C.01 Assess control implementation and operating effectiveness
new-zealand-information-security-manual-nzism::4.3.20.C.024.3.20.C.02 Auditor confirms physical security certification
new-zealand-information-security-manual-nzism::4.3.20.C.034.3.20.C.03 Physical security certification under three years old
new-zealand-information-security-manual-nzism::4.3.21.C.014.3.21.C.01 Auditor report of compliance with remediation
new-zealand-information-security-manual-nzism::4.4.10.C.014.4.10.C.01 GCSB accreditation for compartmented systems
new-zealand-information-security-manual-nzism::4.4.11.C.014.4.11.C.01 NZEO systems under New Zealand national control
new-zealand-information-security-manual-nzism::4.4.12.C.014.4.12.C.01 Reaccreditation at least every three years
new-zealand-information-security-manual-nzism::4.4.12.C.024.4.12.C.02 Notify connected agencies of expired accreditation
new-zealand-information-security-manual-nzism::4.4.12.C.034.4.12.C.03 Notify GCDO of expired accreditation affecting AoG
new-zealand-information-security-manual-nzism::4.4.12.C.044.4.12.C.04 No operation without current accreditation or dispensation
new-zealand-information-security-manual-nzism::4.4.12.C.054.4.12.C.05 Reaccreditation at least every two years
new-zealand-information-security-manual-nzism::4.4.4.C.014.4.4.C.01 Develop an agency accreditation framework
new-zealand-information-security-manual-nzism::4.4.5.C.014.4.5.C.01 Every agency system accredited
new-zealand-information-security-manual-nzism::4.4.5.C.024.4.5.C.02 Accreditation before operational use
new-zealand-information-security-manual-nzism::4.4.5.C.034.4.5.C.03 Accreditation before connecting to other systems
new-zealand-information-security-manual-nzism::4.4.5.C.044.4.5.C.04 Monitoring, logging and auditing on accredited systems
new-zealand-information-security-manual-nzism::4.4.6.C.014.4.6.C.01 Formal agreement on authorities for shared systems
new-zealand-information-security-manual-nzism::4.4.7.C.014.4.7.C.01 Owner notifies authorities of intent to seek accreditation
new-zealand-information-security-manual-nzism::4.4.7.C.024.4.7.C.02 Confirm governance with certification and accreditation authorities
new-zealand-information-security-manual-nzism::4.4.8.C.014.4.8.C.01 Due diligence on third parties receiving agency information
new-zealand-information-security-manual-nzism::4.4.8.C.024.4.8.C.02 Document security expectations for third parties
new-zealand-information-security-manual-nzism::4.4.8.C.034.4.8.C.03 Ongoing assurance of third party security
new-zealand-information-security-manual-nzism::4.4.8.C.044.4.8.C.04 Review accreditation deliverables for receiving parties
new-zealand-information-security-manual-nzism::4.4.9.C.014.4.9.C.01 No processing above accredited classification
new-zealand-information-security-manual-nzism::4.5.17.C.014.5.17.C.01 Certification required for accreditation
new-zealand-information-security-manual-nzism::4.5.18.C.014.5.18.C.01 Accreditation Authority accepts residual risk
new-zealand-information-security-manual-nzism::4.5.18.C.024.5.18.C.02 Advise agencies affected by accreditation decision
new-zealand-information-security-manual-nzism::4.5.18.C.034.5.18.C.03 Advise GCDO when AoG systems affected

Chapter 5: Information security documentation – New Zealand Information Security Manual (NZISM)

47 controls
Controls in the Chapter 5: Information security documentation – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 47 controls
CodeTitle
new-zealand-information-security-manual-nzism::5.1.10.C.015.1.10.C.01 System Security Plan covering every system
new-zealand-information-security-manual-nzism::5.1.11.C.015.1.11.C.01 Standard Operating Procedures developed for systems
new-zealand-information-security-manual-nzism::5.1.12.C.015.1.12.C.01 Incident Response Plan and supporting procedures developed
new-zealand-information-security-manual-nzism::5.1.12.C.025.1.12.C.02 Personnel trained and exercised on the Incident Response Plan
new-zealand-information-security-manual-nzism::5.1.13.C.015.1.13.C.01 Emergency evacuation procedures for securing classified information
new-zealand-information-security-manual-nzism::5.1.14.C.015.1.14.C.01 Security documentation written by knowledgeable personnel
new-zealand-information-security-manual-nzism::5.1.15.C.015.1.15.C.01 Security documents consistent with each other and SecPol
new-zealand-information-security-manual-nzism::5.1.16.C.015.1.16.C.01 Documentation framework describing hierarchy of security documents
new-zealand-information-security-manual-nzism::5.1.16.C.025.1.16.C.02 Use NZISM document names when no framework exists
new-zealand-information-security-manual-nzism::5.1.17.C.015.1.17.C.01 Convert alternative document names to NZISM names
new-zealand-information-security-manual-nzism::5.1.18.C.015.1.18.C.01 Appropriate classification of security documentation
new-zealand-information-security-manual-nzism::5.1.19.C.015.1.19.C.01 Oversight of outsourced security documentation development
new-zealand-information-security-manual-nzism::5.1.20.C.015.1.20.C.01 Formal approval of security documentation by senior authority
new-zealand-information-security-manual-nzism::5.1.20.C.025.1.20.C.02 Approval roles for high-level and system documents
new-zealand-information-security-manual-nzism::5.1.21.C.015.1.21.C.01 Regular review schedule for security documentation
new-zealand-information-security-manual-nzism::5.1.21.C.025.1.21.C.02 Annual and event-driven documentation reviews with recorded dates
new-zealand-information-security-manual-nzism::5.1.7.C.015.1.7.C.01 Agency information security policy (SecPol) in place
new-zealand-information-security-manual-nzism::5.1.8.C.015.1.8.C.01 Documented systems architecture for every system
new-zealand-information-security-manual-nzism::5.1.9.C.015.1.9.C.01 Security Risk Management Plan with named risk owners
new-zealand-information-security-manual-nzism::5.2.3.C.015.2.3.C.01 SecPol sets out security guidelines, standards and responsibilities
new-zealand-information-security-manual-nzism::5.2.3.C.025.2.3.C.02 Topics to be covered in the SecPol
new-zealand-information-security-manual-nzism::5.3.6.C.015.3.6.C.01 Identify agency and system specific security risks
new-zealand-information-security-manual-nzism::5.3.7.C.015.3.7.C.01 SRMP includes risk assessment and treatment strategy
new-zealand-information-security-manual-nzism::5.3.8.C.015.3.8.C.01 SRMP integrated into agency risk management plan
new-zealand-information-security-manual-nzism::5.3.9.C.015.3.9.C.01 SRMP developed to international risk management standards
new-zealand-information-security-manual-nzism::5.4.5.C.015.4.5.C.01 Select SSP controls from NZISM and SRMP
new-zealand-information-security-manual-nzism::5.4.5.C.025.4.5.C.02 Use latest NZISM baseline when developing SSPs
new-zealand-information-security-manual-nzism::5.4.5.C.035.4.5.C.03 Key Management Plan included in the SSP
new-zealand-information-security-manual-nzism::5.5.3.C.015.5.3.C.01 SOPs for ITSM, administrator and user roles
new-zealand-information-security-manual-nzism::5.5.4.C.015.5.4.C.01 Procedures required in the ITSM SOPs
new-zealand-information-security-manual-nzism::5.5.5.C.015.5.5.C.01 Procedures required in the system administrator SOPs
new-zealand-information-security-manual-nzism::5.5.6.C.015.5.6.C.01 Procedures required in the system user SOPs
new-zealand-information-security-manual-nzism::5.5.7.C.015.5.7.C.01 Signed agreement to follow SOPs
new-zealand-information-security-manual-nzism::5.6.3.C.015.6.3.C.01 Mandatory minimum content of the IRP
new-zealand-information-security-manual-nzism::5.6.3.C.025.6.3.C.02 Recommended additional content of the IRP
new-zealand-information-security-manual-nzism::5.7.4.C.015.7.4.C.01 Secure classified information before evacuating a facility
new-zealand-information-security-manual-nzism::5.8.61.C.015.8.61.C.01 Risk assessment to set independent assurance needs
new-zealand-information-security-manual-nzism::5.8.61.C.025.8.61.C.02 Obtain independent assurance reports when direct assurance impossible
new-zealand-information-security-manual-nzism::5.8.61.C.035.8.61.C.03 Use assurance reports and certifications to inform risk
new-zealand-information-security-manual-nzism::5.8.62.C.015.8.62.C.01 Independent assurance results feed the certification process
new-zealand-information-security-manual-nzism::5.9.23.C.015.9.23.C.01 Risk assessment to scope the vulnerability disclosure policy
new-zealand-information-security-manual-nzism::5.9.24.C.015.9.24.C.01 Develop and publish a vulnerability disclosure policy
new-zealand-information-security-manual-nzism::5.9.24.C.025.9.24.C.02 Mandatory core content of the VDP
new-zealand-information-security-manual-nzism::5.9.25.C.015.9.25.C.01 Publish a security.txt file for vulnerability reports
new-zealand-information-security-manual-nzism::5.9.26.C.015.9.26.C.01 Address disclosed vulnerabilities within stated timeframe
new-zealand-information-security-manual-nzism::5.9.26.C.025.9.26.C.02 Disclosure timeframe of no more than 90 days
new-zealand-information-security-manual-nzism::5.9.27.C.015.9.27.C.01 Integrate VDP with other security policies

Chapter 6: Information security monitoring – New Zealand Information Security Manual (NZISM)

16 controls
Controls in the Chapter 6: Information security monitoring – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 16 controls
CodeTitle
new-zealand-information-security-manual-nzism::6.1.7.C.016.1.7.C.01 Annual documented information security reviews of systems
new-zealand-information-security-manual-nzism::6.1.8.C.016.1.8.C.01 Independent personnel conduct information security reviews
new-zealand-information-security-manual-nzism::6.1.9.C.016.1.9.C.01 Components and triggers for information security reviews
new-zealand-information-security-manual-nzism::6.2.4.C.016.2.4.C.01 Vulnerability analysis strategy for systems
new-zealand-information-security-manual-nzism::6.2.5.C.016.2.5.C.01 Baseline vulnerability assessments and their triggers
new-zealand-information-security-manual-nzism::6.2.6.C.016.2.6.C.01 Analyse and treat all identified vulnerabilities
new-zealand-information-security-manual-nzism::6.3.6.C.016.3.6.C.01 Change management steps for TOP SECRET systems
new-zealand-information-security-manual-nzism::6.3.6.C.026.3.6.C.02 Change management steps for routine and urgent changes
new-zealand-information-security-manual-nzism::6.3.7.C.016.3.7.C.01 Urgent change actions defined for TOP SECRET systems
new-zealand-information-security-manual-nzism::6.3.7.C.026.3.7.C.02 Urgent change actions defined in change process
new-zealand-information-security-manual-nzism::6.3.7.C.036.3.7.C.03 Outline change management process to follow
new-zealand-information-security-manual-nzism::6.3.8.C.016.3.8.C.01 Reaccredit systems after risk-changing configuration changes
new-zealand-information-security-manual-nzism::6.4.5.C.016.4.5.C.01 Availability and recovery requirements with supporting measures
new-zealand-information-security-manual-nzism::6.4.6.C.016.4.6.C.01 Backup of vital records with offsite storage and testing
new-zealand-information-security-manual-nzism::6.4.7.C.016.4.7.C.01 Documented business continuity plan
new-zealand-information-security-manual-nzism::6.4.8.C.016.4.8.C.01 Documented disaster recovery plan

Chapter 7: Information Security Incidents – New Zealand Information Security Manual (NZISM)

29 controls
Controls in the Chapter 7: Information Security Incidents – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 29 controls
CodeTitle
new-zealand-information-security-manual-nzism::7.1.7.C.017.1.7.C.01 Incident detection tools and procedures for classified systems
new-zealand-information-security-manual-nzism::7.1.7.C.027.1.7.C.02 Incident detection tools and procedures including network defence
new-zealand-information-security-manual-nzism::7.1.7.C.037.1.7.C.03 Balance prevention and detection resources using risk assessment
new-zealand-information-security-manual-nzism::7.2.17.C.017.2.17.C.01 Personnel report incidents promptly to the ITSM
new-zealand-information-security-manual-nzism::7.2.17.C.027.2.17.C.02 Reporting weaknesses, malfunctions and quantifying incidents
new-zealand-information-security-manual-nzism::7.2.18.C.017.2.18.C.01 ITSM keeps the CISO informed of incidents
new-zealand-information-security-manual-nzism::7.2.20.C.017.2.20.C.01 ITSM reports critical and serious incidents to NCSC
new-zealand-information-security-manual-nzism::7.2.20.C.027.2.20.C.02 Report low category incidents to NCSC
new-zealand-information-security-manual-nzism::7.2.20.C.037.2.20.C.03 Share post-incident review reports with NCSC
new-zealand-information-security-manual-nzism::7.2.22.C.017.2.22.C.01 Service providers advise and consult agency on incidents
new-zealand-information-security-manual-nzism::7.2.23.C.017.2.23.C.01 Notify users of keying material loss or compromise
new-zealand-information-security-manual-nzism::7.2.24.C.017.2.24.C.01 Urgent replacement of compromised cryptographic keys
new-zealand-information-security-manual-nzism::7.2.25.C.017.2.25.C.01 Urgent notification to GCSB of HACE keying compromise
new-zealand-information-security-manual-nzism::7.3.10.C.017.3.10.C.01 Legal advice before allowing an attacker to continue
new-zealand-information-security-manual-nzism::7.3.11.C.017.3.11.C.01 Preserve evidence and record investigation actions
new-zealand-information-security-manual-nzism::7.3.12.C.017.3.12.C.01 Prompt NCSC assistance requests without disturbing evidence
new-zealand-information-security-manual-nzism::7.3.5.C.017.3.5.C.01 Incident responsibilities and procedures documented per system
new-zealand-information-security-manual-nzism::7.3.6.C.017.3.6.C.01 Register of all information security incidents
new-zealand-information-security-manual-nzism::7.3.6.C.027.3.6.C.02 Use incident register for future risk assessments
new-zealand-information-security-manual-nzism::7.3.7.C.017.3.7.C.01 Procedures to detect data spills and breaches
new-zealand-information-security-manual-nzism::7.3.7.C.027.3.7.C.02 Assume highest classification compromised after a spill
new-zealand-information-security-manual-nzism::7.3.7.C.037.3.7.C.03 SOP procedures for reporting spills and unauthorised access
new-zealand-information-security-manual-nzism::7.3.7.C.047.3.7.C.04 Data spill procedures documented in the IRP
new-zealand-information-security-manual-nzism::7.3.7.C.057.3.7.C.05 Handle data spills as incidents under the IRP
new-zealand-information-security-manual-nzism::7.3.7.C.067.3.7.C.06 Report breaches to Privacy Commissioner and owner
new-zealand-information-security-manual-nzism::7.3.8.C.017.3.8.C.01 Immediate containment steps when a data spill occurs
new-zealand-information-security-manual-nzism::7.3.8.C.027.3.8.C.02 No copying, viewing, printing or emailing spilled information
new-zealand-information-security-manual-nzism::7.3.8.C.037.3.8.C.03 Contact NCSC when spilled systems cannot be isolated
new-zealand-information-security-manual-nzism::7.3.9.C.017.3.9.C.01 Steps to follow when malicious code is detected

Chapter 8: Physical Security – New Zealand Information Security Manual (NZISM)

30 controls
Controls in the Chapter 8: Physical Security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 30 controls
CodeTitle
new-zealand-information-security-manual-nzism::8.1.10.C.018.1.10.C.01 Facilities housing systems certified and accredited under PSR
new-zealand-information-security-manual-nzism::8.1.11.C.018.1.11.C.01 Prevent unauthorised observation of systems
new-zealand-information-security-manual-nzism::8.1.11.C.028.1.11.C.02 Position workstations away from windows and doorways
new-zealand-information-security-manual-nzism::8.1.12.C.018.1.12.C.01 No non-agency devices in TOP SECRET areas without approval
new-zealand-information-security-manual-nzism::8.1.13.C.018.1.13.C.01 Technical surveillance counter-measure tests during physical certification
new-zealand-information-security-manual-nzism::8.1.13.C.028.1.13.C.02 Decide on further TSCM testing after visitor access
new-zealand-information-security-manual-nzism::8.2.5.C.018.2.5.C.01 Servers and network devices secured in cabinets
new-zealand-information-security-manual-nzism::8.2.6.C.018.2.6.C.01 Control keys to server and communications rooms
new-zealand-information-security-manual-nzism::8.2.6.C.028.2.6.C.02 Server rooms and containers never left unsecured
new-zealand-information-security-manual-nzism::8.2.7.C.018.2.7.C.01 Site Security Plan for each server and communications room
new-zealand-information-security-manual-nzism::8.2.8.C.018.2.8.C.01 Signposting and securing no-lone-zones
new-zealand-information-security-manual-nzism::8.3.3.C.018.3.3.C.01 Certify facilities with network infrastructure to highest classification
new-zealand-information-security-manual-nzism::8.3.3.C.028.3.3.C.02 Encrypt classified traffic in secure areas
new-zealand-information-security-manual-nzism::8.3.4.C.018.3.4.C.01 Lockable cabinets for TOP SECRET network panels
new-zealand-information-security-manual-nzism::8.3.4.C.028.3.4.C.02 Lockable cabinets for patch panels and enclosures
new-zealand-information-security-manual-nzism::8.3.5.C.018.3.5.C.01 Encrypt classified traffic over public or unsecure infrastructure
new-zealand-information-security-manual-nzism::8.4.10.C.018.4.10.C.01 Secure IT equipment with media when unoccupied
new-zealand-information-security-manual-nzism::8.4.11.C.018.4.11.C.01 Risk assess and document non-volatile media storage choices
new-zealand-information-security-manual-nzism::8.4.12.C.018.4.12.C.01 Securing volatile media outside operational hours
new-zealand-information-security-manual-nzism::8.4.13.C.018.4.13.C.01 Encrypt media in IT equipment with approved algorithm
new-zealand-information-security-manual-nzism::8.4.8.C.018.4.8.C.01 Account for all IT equipment containing media
new-zealand-information-security-manual-nzism::8.4.9.C.018.4.9.C.01 Certify IT equipment facilities to highest classification
new-zealand-information-security-manual-nzism::8.5.3.C.018.5.3.C.01 Secured register of seal usage for TOP SECRET
new-zealand-information-security-manual-nzism::8.5.3.C.028.5.3.C.02 Seal register details for TOP SECRET systems
new-zealand-information-security-manual-nzism::8.5.3.C.038.5.3.C.03 Secured register of seal usage
new-zealand-information-security-manual-nzism::8.5.3.C.048.5.3.C.04 Seal register details for issue, serials and locations
new-zealand-information-security-manual-nzism::8.5.4.C.018.5.4.C.01 Seals bearing unique agency identifier or image
new-zealand-information-security-manual-nzism::8.5.4.C.028.5.4.C.02 Secure seals and tools when not in use
new-zealand-information-security-manual-nzism::8.5.4.C.038.5.4.C.03 Contractors not to buy seals independently
new-zealand-information-security-manual-nzism::8.5.5.C.018.5.5.C.01 Annual seal review against register and tamper check

Chapter 9: Personnel Security – New Zealand Information Security Manual (NZISM)

48 controls
Controls in the Chapter 9: Personnel Security – New Zealand Information Security Manual (NZISM) domain of New Zealand Information Security Manual (NZISM): 48 controls
CodeTitle
new-zealand-information-security-manual-nzism::9.1.4.C.019.1.4.C.01 Management ensures system users are trained and security aware
new-zealand-information-security-manual-nzism::9.1.5.C.019.1.5.C.01 Ongoing security awareness and training programme for personnel
new-zealand-information-security-manual-nzism::9.1.5.C.029.1.5.C.02 Security awareness training included in staff induction
new-zealand-information-security-manual-nzism::9.1.6.C.019.1.6.C.01 Tailor awareness training to user responsibilities
new-zealand-information-security-manual-nzism::9.1.6.C.029.1.6.C.02 Required topics in security awareness and training content
new-zealand-information-security-manual-nzism::9.1.6.C.039.1.6.C.03 Training warns users against prohibited system actions
new-zealand-information-security-manual-nzism::9.1.7.C.019.1.7.C.01 TOP SECRET familiarisation training before unsupervised access
new-zealand-information-security-manual-nzism::9.1.8.C.019.1.8.C.01 Caution staff on courses attended with non-government people
new-zealand-information-security-manual-nzism::9.2.10.C.019.2.10.C.01 SSP specifies authorisations, clearances and briefings for access
new-zealand-information-security-manual-nzism::9.2.11.C.019.2.11.C.01 TOP SECRET need-to-know, least privilege and authorised requests
new-zealand-information-security-manual-nzism::9.2.11.C.029.2.11.C.02 Need-to-know access, least privilege and briefing acknowledgement
new-zealand-information-security-manual-nzism::9.2.12.C.019.2.12.C.01 Secure record of authorised users and access authorisations
new-zealand-information-security-manual-nzism::9.2.13.C.019.2.13.C.01 No CONFIDENTIAL or above access without completed clearance
new-zealand-information-security-manual-nzism::9.2.13.C.029.2.13.C.02 Users hold appropriate clearance or PSR emergency access
new-zealand-information-security-manual-nzism::9.2.14.C.019.2.14.C.01 Briefings before access to compartmented or endorsed information
new-zealand-information-security-manual-nzism::9.2.15.C.019.2.15.C.01 No foreign national access where NZEO information unprotected
new-zealand-information-security-manual-nzism::9.2.15.C.029.2.15.C.02 No foreign national access to NZEO-protected systems
new-zealand-information-security-manual-nzism::9.2.16.C.019.2.16.C.01 Foreign nationals limited to information releasable to their nation
new-zealand-information-security-manual-nzism::9.2.17.C.019.2.17.C.01 No limited higher access at CONFIDENTIAL and above
new-zealand-information-security-manual-nzism::9.2.17.C.029.2.17.C.02 Conditions for granting limited higher access
new-zealand-information-security-manual-nzism::9.2.18.C.019.2.18.C.01 Controls on users granted limited higher access
new-zealand-information-security-manual-nzism::9.2.19.C.019.2.19.C.01 Emergency access requires at least CONFIDENTIAL clearance
new-zealand-information-security-manual-nzism::9.2.19.C.029.2.19.C.02 Emergency access not used for pending clearance reassignments
new-zealand-information-security-manual-nzism::9.2.19.C.039.2.19.C.03 Conditions for granting emergency system access
new-zealand-information-security-manual-nzism::9.2.19.C.049.2.19.C.04 Debrief emergency access holders when emergency ends
new-zealand-information-security-manual-nzism::9.2.20.C.019.2.20.C.01 No limited higher access to endorsed or compartmented systems
new-zealand-information-security-manual-nzism::9.3.10.C.019.3.10.C.01 Block file receipt via peer-to-peer, IM or IRC
new-zealand-information-security-manual-nzism::9.3.4.C.019.3.4.C.01 Report suspicious Internet contact or questioning to ITSM
new-zealand-information-security-manual-nzism::9.3.5.C.019.3.5.C.01 Make users aware of agency Web usage policies
new-zealand-information-security-manual-nzism::9.3.5.C.029.3.5.C.02 Formal acceptance of Web usage policies by personnel
new-zealand-information-security-manual-nzism::9.3.6.C.019.3.6.C.01 Monitor compliance with Web usage policies
new-zealand-information-security-manual-nzism::9.3.7.C.019.3.7.C.01 Instruct personnel to take care posting on the Web
new-zealand-information-security-manual-nzism::9.3.7.C.029.3.7.C.02 Separate professional and personal Web accounts
new-zealand-information-security-manual-nzism::9.3.7.C.039.3.7.C.03 Monitor staff postings and remove inappropriate information
new-zealand-information-security-manual-nzism::9.3.7.C.049.3.7.C.04 Discourage personal account access from agency systems
new-zealand-information-security-manual-nzism::9.3.8.C.019.3.8.C.01 Inform staff of risks of posting personal information
new-zealand-information-security-manual-nzism::9.3.8.C.029.3.8.C.02 Encourage privacy settings on personal web postings
new-zealand-information-security-manual-nzism::9.3.8.C.039.3.8.C.03 Encourage staff self-searches for exposed personal information
new-zealand-information-security-manual-nzism::9.3.9.C.019.3.9.C.01 Restrict peer-to-peer applications over the Internet
new-zealand-information-security-manual-nzism::9.4.10.C.019.4.10.C.01 Separate visitor log for TOP SECRET area in facility
new-zealand-information-security-manual-nzism::9.4.4.C.019.4.4.C.01 Clearances and briefings for unescorted TOP SECRET area access
new-zealand-information-security-manual-nzism::9.4.5.C.019.4.5.C.01 Current list of personnel with unescorted TOP SECRET access
new-zealand-information-security-manual-nzism::9.4.5.C.029.4.5.C.02 Display identity cards at all times in secure area
new-zealand-information-security-manual-nzism::9.4.6.C.019.4.6.C.01 Display unescorted access list inside TOP SECRET area
new-zealand-information-security-manual-nzism::9.4.6.C.029.4.6.C.02 Unescorted access list hidden from outside secure area
new-zealand-information-security-manual-nzism::9.4.7.C.019.4.7.C.01 Supervise visitors to prevent unauthorised information exposure
new-zealand-information-security-manual-nzism::9.4.8.C.019.4.8.C.01 Escort and log visitors not on unescorted list
new-zealand-information-security-manual-nzism::9.4.9.C.019.4.9.C.01 Minimum visitor log fields for TOP SECRET areas

Your Compliance Coverage

If you comply with New Zealand Information Security Manual (NZISM), you already cover:

Australian Information Security Manual

19%

275 controls mapped

Compare →

ISO 27002:2022

5%

72 controls mapped

Compare →

US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule

0%

4 controls mapped

Compare →

+ 132 more: OWASP DevSecOps Maturity Model (DSOMM) (0%), NIST SP 800-146 (0%)

See all 135 mapped frameworks ↓

Maps to 135 other frameworks

1433 total controls
Australian Information Security Manual
275 source controls mapped|226 target controls covered
19%
ISO 27002:2022
72 source controls mapped|39 target controls covered
5%
US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule
4 source controls mapped|3 target controls covered
0%
OWASP DevSecOps Maturity Model (DSOMM)
4 source controls mapped|4 target controls covered
0%
NIST SP 800-146
4 source controls mapped|3 target controls covered
0%
NIST SP 800-145
4 source controls mapped|4 target controls covered
0%
NIST SP 800-144
4 source controls mapped|5 target controls covered
0%
NIST SP 800-190
4 source controls mapped|8 target controls covered
0%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
3 source controls mapped|4 target controls covered
0%
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
3 source controls mapped|4 target controls covered
0%
South Korea ISMS-P
3 source controls mapped|7 target controls covered
0%
NIST SP 800-53 Rev 5
3 source controls mapped|12 target controls covered
0%
ASD Strategies to Mitigate Cyber Security Incidents
3 source controls mapped|7 target controls covered
0%
ISO/IEC 27011:2024
3 source controls mapped|4 target controls covered
0%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
3 source controls mapped|6 target controls covered
0%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
3 source controls mapped|8 target controls covered
0%
NIST SP 1800-32
3 source controls mapped|5 target controls covered
0%
IAIS Insurance Core Principles (ICPs)
3 source controls mapped|4 target controls covered
0%
US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties
3 source controls mapped|5 target controls covered
0%
Kuwait National Cybersecurity Framework
3 source controls mapped|1 target controls covered
0%
ISO/IEC 29134:2023
3 source controls mapped|4 target controls covered
0%
IEC 62443
3 source controls mapped|5 target controls covered
0%
API 1164
3 source controls mapped|5 target controls covered
0%
BSI IT-Grundschutz
3 source controls mapped|5 target controls covered
0%
NIST Cybersecurity Framework 2.0
3 source controls mapped|6 target controls covered
0%
ISO/IEC 29147:2018
3 source controls mapped|3 target controls covered
0%
Singapore Government Instruction Manual on ICT&SS Management (IM8)
3 source controls mapped|5 target controls covered
0%
FFIEC IT Examination Handbook
3 source controls mapped|5 target controls covered
0%
FTC GLBA Safeguards Rule (16 CFR Part 314)
3 source controls mapped|2 target controls covered
0%
ISO/IEC 27019:2024
3 source controls mapped|5 target controls covered
0%
South Korea PIPA
3 source controls mapped|3 target controls covered
0%
Turkey KVKK
3 source controls mapped|2 target controls covered
0%
Privacy Act 1988 (Australia)
3 source controls mapped|4 target controls covered
0%
Personal Data Act (personopplysningsloven)
3 source controls mapped|4 target controls covered
0%
NIST SP 800-122
3 source controls mapped|3 target controls covered
0%
NIST Privacy Framework
3 source controls mapped|3 target controls covered
0%
Nigeria Data Protection Regulation (NDPR)
3 source controls mapped|3 target controls covered
0%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
3 source controls mapped|4 target controls covered
0%
ISO 22000:2018
3 source controls mapped|2 target controls covered
0%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
3 source controls mapped|6 target controls covered
0%
Bahrain PDPL
3 source controls mapped|4 target controls covered
0%
OWASP Top 10:2025
2 source controls mapped|3 target controls covered
0%
OWASP MASVS
2 source controls mapped|3 target controls covered
0%
OWASP ASVS
2 source controls mapped|3 target controls covered
0%
NIST SP 800-92
2 source controls mapped|3 target controls covered
0%
NIST SP 800-88
2 source controls mapped|3 target controls covered
0%
NIST SP 800-63-4
2 source controls mapped|2 target controls covered
0%
NIST SP 800-61 Rev. 3
2 source controls mapped|3 target controls covered
0%
NIST SP 800-137
2 source controls mapped|2 target controls covered
0%
NIST SP 800-123
2 source controls mapped|3 target controls covered
0%
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)
2 source controls mapped|2 target controls covered
0%
FFIEC Cybersecurity Assessment Tool (CAT)
2 source controls mapped|6 target controls covered
0%
ISO/IEC 27043:2015
2 source controls mapped|6 target controls covered
0%
ISO/SAE 21434
2 source controls mapped|6 target controls covered
0%
NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices
2 source controls mapped|5 target controls covered
0%
ISO/IEC 27400:2022
2 source controls mapped|3 target controls covered
0%
ISO/IEC 27010:2015
2 source controls mapped|2 target controls covered
0%
ISO 28001:2007 Supply Chain Security Management
2 source controls mapped|3 target controls covered
0%
FedRAMP High
2 source controls mapped|3 target controls covered
0%
FedRAMP Moderate
2 source controls mapped|3 target controls covered
0%
Regulation on the European Health Data Space (EHDS)
2 source controls mapped|3 target controls covered
0%
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
2 source controls mapped|2 target controls covered
0%
Vietnam Law on Cybersecurity (No. 116/2025/QH15)
2 source controls mapped|2 target controls covered
0%
Vermont Data Privacy and Online Surveillance Act
2 source controls mapped|1 target controls covered
0%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
2 source controls mapped|1 target controls covered
0%
PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR)
2 source controls mapped|2 target controls covered
0%
NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
2 source controls mapped|2 target controls covered
0%
NIST SP 800-66
2 source controls mapped|3 target controls covered
0%
NIST SP 800-39
2 source controls mapped|3 target controls covered
0%
NIST SP 800-37
2 source controls mapped|4 target controls covered
0%
NIST SP 800-30
2 source controls mapped|6 target controls covered
0%
Nigeria Open Banking Regulatory Framework (CBN, 2023)
2 source controls mapped|2 target controls covered
0%
EASA Part-IS - Information Security in Aviation
2 source controls mapped|5 target controls covered
0%
AML/CTF Act 2006 (Australia)
2 source controls mapped|2 target controls covered
0%
ISO/IEC 23894:2023
2 source controls mapped|6 target controls covered
0%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
2 source controls mapped|7 target controls covered
0%
APRA CPS 230 Operational Risk Management
2 source controls mapped|4 target controls covered
0%
ISO 22313:2020 - Guidance on Business Continuity Management Systems
2 source controls mapped|1 target controls covered
0%
FBI CJIS Security Policy
2 source controls mapped|6 target controls covered
0%
ISO/IEC 27031:2011
2 source controls mapped|1 target controls covered
0%
NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management
2 source controls mapped|1 target controls covered
0%
ISO/IEC 27003:2017
2 source controls mapped|2 target controls covered
0%
GDPR
2 source controls mapped|2 target controls covered
0%
ASIS SPC.1-2009 - Organizational Resilience Standard
2 source controls mapped|1 target controls covered
0%
ISO 27799:2025
2 source controls mapped|4 target controls covered
0%
SQF Code Edition 9 - Safe Quality Food
2 source controls mapped|2 target controls covered
0%
ISO 26262:2018 - Functional Safety for Road Vehicles
2 source controls mapped|1 target controls covered
0%
Annex 11 to EU GMP - Computerised Systems
2 source controls mapped|1 target controls covered
0%
ICAO Annex 17 - Aviation Security (AVSEC)
2 source controls mapped|2 target controls covered
0%
French Sapin II Law (Law No. 2016-1691)
2 source controls mapped|2 target controls covered
0%
Barbados Data Protection Act 2019
2 source controls mapped|2 target controls covered
0%
ISO/IEC 30111:2019
1 source controls mapped|5 target controls covered
0%
US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements
1 source controls mapped|1 target controls covered
0%
UN Guiding Principles on Business and Human Rights (UNGPs)
1 source controls mapped|1 target controls covered
0%
TEFCA - Trusted Exchange Framework and Common Agreement
1 source controls mapped|1 target controls covered
0%
ISO/IEC 27006-1:2024
1 source controls mapped|1 target controls covered
0%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
1 source controls mapped|1 target controls covered
0%
Florida Digital Bill of Rights (FDBR)
1 source controls mapped|1 target controls covered
0%
ISO 45001:2018
1 source controls mapped|1 target controls covered
0%
ISO 14001:2015
1 source controls mapped|1 target controls covered
0%
Protective Security Policy Framework (PSPF) Release 2026
1 source controls mapped|1 target controls covered
0%
OCC Heightened Standards (12 CFR Part 30, Appendix D)
1 source controls mapped|2 target controls covered
0%
APRA CPS 234
1 source controls mapped|2 target controls covered
0%
IEC 60601-1 - Medical Electrical Equipment Safety
1 source controls mapped|3 target controls covered
0%
IEC 62304:2015 Medical Device Software Lifecycle Processes
1 source controls mapped|3 target controls covered
0%
ISO 20400:2017 - Sustainable Procurement
1 source controls mapped|1 target controls covered
0%
ISO 22320:2018
1 source controls mapped|1 target controls covered
0%
AS9100D - Aerospace Quality Management System
1 source controls mapped|1 target controls covered
0%
Aged Care Quality Standards 2019 (repealed edition)
1 source controls mapped|1 target controls covered
0%
BS 65000:2014 - Guidance on Organizational Resilience
1 source controls mapped|2 target controls covered
0%
Space ISAC (Information Sharing and Analysis Center) - Threat Framework
1 source controls mapped|1 target controls covered
0%
Singapore AI Governance Framework
1 source controls mapped|1 target controls covered
0%
ICH Q10 - Pharmaceutical Quality System
1 source controls mapped|1 target controls covered
0%
IATA Operational Safety Audit (IOSA) Standards Manual
1 source controls mapped|1 target controls covered
0%
ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence
1 source controls mapped|1 target controls covered
0%
USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)
1 source controls mapped|1 target controls covered
0%
Russia Federal Law on Personal Data (152-FZ)
1 source controls mapped|1 target controls covered
0%
Pakistan Personal Data Protection Bill 2023
1 source controls mapped|1 target controls covered
0%
OWASP API Security Top 10 - 2023
1 source controls mapped|1 target controls covered
0%
NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)
1 source controls mapped|4 target controls covered
0%
Nigeria Data Protection Act 2023 (NDPA)
1 source controls mapped|1 target controls covered
0%
Nebraska Data Privacy Act
1 source controls mapped|1 target controls covered
0%
ISO/IEC 23837:2023
1 source controls mapped|3 target controls covered
0%
Albania Law No. 124/2024 on Personal Data Protection
1 source controls mapped|1 target controls covered
0%
FedRAMP Rev 5
1 source controls mapped|3 target controls covered
0%
Armenia Law on Protection of Personal Data (2015)
1 source controls mapped|1 target controls covered
0%
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework
1 source controls mapped|1 target controls covered
0%
Canada ITSG-33 - IT Security Risk Management
1 source controls mapped|1 target controls covered
0%
Azerbaijan Law on Personal Data (2010)
1 source controls mapped|1 target controls covered
0%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
1 source controls mapped|1 target controls covered
0%
APPI
1 source controls mapped|1 target controls covered
0%
Australian Privacy Principles (APPs)
1 source controls mapped|1 target controls covered
0%
NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding)
1 source controls mapped|1 target controls covered
0%
FIDO2 / WebAuthn
1 source controls mapped|1 target controls covered
0%
IEC 62351 - Power Systems Communication Security
1 source controls mapped|1 target controls covered
0%
Compare New Zealand Information Security Manual (NZISM) with Australian Information Security Manual

Coverage is not the same as your position

This page shows what New Zealand Information Security Manual (NZISM) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is New Zealand Information Security Manual (NZISM) and who does it apply to?

New Zealand Information Security Manual (NZISM) is a compliance framework from New Zealand (GCSB / NCSC; published by the GCISO) with 23 domains and 1425 controls. The New Zealand Government's information security manual, published by the GCISO and maintained by the GCSB's National Cyber Security Centre: 1,425 controls across 23 chapters, each with a control identifier, a classification scope (All Classifications or CONFIDENTIAL, SECRET and TOP SECRET) and a compliance level (MUST, MUST NOT, SHOULD, SHOULD NOT), covering governance and roles, certification and accreditation, security documentation, monitoring, incidents, physical and personnel security, infrastructure and cabling, communications devices, product and media security, software, email, authentication and access, cryptography, network and gateway security, data management, distributed working, enterprise systems and public cloud. Built at control level from the v3.9 content (released 9 May 2025), read in full. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does New Zealand Information Security Manual (NZISM) actually require?

New Zealand Information Security Manual (NZISM) has 1425 controls organised across 23 domains. The largest domains are Chapter 18: Network security – New Zealand Information Security Manual (NZISM) (118 controls), Chapter 11: Communications Systems and Devices – New Zealand Information Security Manual (NZISM) (114 controls), Chapter 16: Authentication and Access Controls – New Zealand Information Security Manual (NZISM) (101 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of New Zealand Information Security Manual (NZISM) do I already cover?

New Zealand Information Security Manual (NZISM) maps to 135 other compliance frameworks. The top mapping partners are Australian Information Security Manual (19% coverage), ISO 27002:2022 (5% coverage), US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule (0% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement New Zealand Information Security Manual (NZISM)?

Start your New Zealand Information Security Manual (NZISM) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about New Zealand Information Security Manual (NZISM) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 1425 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required