New Zealand Information Security Manual (NZISM): every control, and what you already have

8 controls 144 frameworks share controls with it New Zealand (GCSB/NCSC) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
ISO 27017	4	measure it →
ISO 27018	4	measure it →
NIST SP 800-144	4	measure it →
NIST SP 800-145	4	measure it →
NIST SP 800-146	4	measure it →
NIST SP 800-190	4	measure it →
OWASP DevSecOps Maturity Model (DSOMM)	4	measure it →
US Gramm-Leach-Bliley Act (GLBA)	4	measure it →
API 1164	3	measure it →
ASD Strategies to Mitigate Cyber Security Incidents	3	measure it →
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)	3	measure it →
Bahrain PDPL	3	measure it →

Every control

Code	Control	Also in
`NZISM-1`	NZISM Governance, Documentation, and Classification System	95
`NZISM-2`	Certification and Accreditation (C&A) for Government Systems	28
`NZISM-3`	Personnel Security, Physical Security, and Cryptography	115
`NZISM-4`	Access Control, Authentication, and Communications Security	0
`NZISM-5`	Network Security, System Hardening, and Application Security	60
`NZISM-6`	Event Logging, Monitoring, Incident Response, and Business Continuity	0
`NZISM-7`	Media Handling, Outsourcing, Cloud Services, and Remote Access	0
`NZISM-8`	Security Risk Management, Vulnerability Management, and Incident Reporting	0

Tell me when New Zealand Information Security Manual (NZISM) files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

OT asset inventory
Zone and conduit diagram
Patch register
Remote access policy
Infrastructure/virtualization security policy
Network segmentation + defense architecture
Administrative Court review procedure
DSS investigation response plan
Sanctions exposure register (EUR 10M-20M + 2-4% turnover)
Liechtenstein Penal Code Articles 188 + 195 awareness

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Flat networks named by 8 frameworks
No certification named by 7 frameworks
Patches exceed SLA named by 4 frameworks
No annual pen test named by 3 frameworks
Non-APL products named by 3 frameworks

What this page is

A control-level reference for New Zealand Information Security Manual (NZISM), drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition