nzism

Confirm the agency type, system classification level, and current security posture, then assess each applicable NZISM control as Implemented, Partial, Not Implemented, or N/A with evidence needed and gap notes. Higher classifications inherit all controls from lower levels.

C&A requires a System Security Plan and Security Risk Management Plan, independent control validation, certification sign-off, a POA&M for findings, and formal accreditation by the Accreditation Authority granting Authorisation to Operate. It is mandatory for systems handling Restricted information and above.

Offshore hosting is a risk-based decision, not a prohibition. It requires a documented cloud risk assessment, jurisdiction and sovereignty analysis, classification-appropriate controls such as encryption with agency-controlled keys, and formal risk acceptance by the Accreditation Authority.

RESTRICTED systems need all baseline controls plus encryption at rest and in transit, MFA for remote access, privileged account separation, 12-month log retention, supplier security assessments, and formal Certification and Accreditation before go-live.

Significant cyber incidents go to the NCSC within GCSB, criminal acts to NZ Police, and notifiable privacy breaches involving serious harm to the Office of the Privacy Commissioner under the Privacy Act 2020.