New Zealand NZISM 3.6 — New Zealand Information Security Manual
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting. Framework text may require a separate license unless explicitly provided.
Overview
New Zealand Information Security Manual (NZISM) 3.6 is a national cybersecurity framework that provides security controls and guidance to help New Zealand government agencies protect their information and systems.
Why it Matters
NZISM 3.6 establishes a comprehensive baseline for information security in New Zealand government agencies. Key benefits include:
- Strengthen cybersecurity governance
Establish consistent security policies and accountability structures across government agencies and their service providers.
- Enhance regulatory compliance
Support alignment with New Zealand government security requirements and international standards, facilitating audits and reviews.
- Improve risk management
Provide a risk-based control framework enabling agencies to prioritize and address security threats effectively.
- Increase audit readiness
Maintain structured documentation and evidence of control implementation to demonstrate compliance during assessments.
How it Works
NZISM 3.6 is organized around security control families addressing governance, risk management, physical security, access control, network security, and incident management, with controls mapped to classification levels.
Key Elements
- Security Control Families
Organizes technical and administrative controls into domains for systematic implementation across government environments.
- Classification-Based Requirements
Maps security controls to information classification levels from unclassified through to highly restricted.
- Risk Management Framework
Provides guidance for conducting risk assessments and selecting appropriate controls based on risk exposure.
- Compliance Assessment Processes
Defines requirements for ongoing monitoring, audit, and assurance of security control effectiveness.
Framework Scope
NZISM 3.6 is implemented by New Zealand government agencies and their service providers handling government information and systems.
Framework Objectives
NZISM 3.6 establishes security requirements to protect New Zealand government information and enable safe digital operations.
- Protect government information through robust security controls and risk management
- Strengthen cybersecurity governance and oversight across public sector agencies
- Support compliance with government security policies and international standards
- Enable audit readiness through structured control implementation and documentation
- ClassicifationCategoryCybersecurityDomainCybersecurityFramework FamilyOther
- Regulatory ContextTypeFrameworkLegal InstrumentStandardSectorGovernment SectorIndustryGovernment & Public Sector
- Region / PublisherRegionAustralia & New ZealandRegion DetailNew ZealandPublisherNational Cyber Security Centre (NCSC)
- VersioningVersionNZISM Version 3.6Effective Date2023Issue Date2023
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The NZISM is publicly available through the New Zealand National Cyber Security Centre.
How SmartSuite Supports NZISM 3.6
Manage New Zealand Information Security Manual (NZISM 3.6) requirements by organizing government security controls, tracking system compliance, and maintaining evidence supporting protection of sensitive information systems.
Government Security Control Framework
Structure NZISM controls with ownership, scope, and implementation tracking across systems.
System Classification and Security Baselines
Classify systems and apply appropriate baseline security controls based on sensitivity.
Authentication and Access Governance
Manage authentication, authorization, and user access aligned to NZISM requirements.
Network Security and System Hardening
Track secure configurations, network protections, and system hardening practices.
System Activity Monitoring and Incident Response
Monitor system activity and manage incident response workflows and escalation processes.
NZISM Compliance and Government Reporting
Provide dashboards showing control coverage, system compliance status, and NZISM readiness.
Related frameworks
The Australia Information Security Manual provides mandated cybersecurity controls and guidance to protect Australian government systems and data.
CIS Controls v8.1 provides prioritized, practical security actions to help organizations mitigate common cyber threats and strengthen defenses.
ISO/IEC 27001:2022 is an international ISMS standard that helps organizations manage information security risks and protect data.
ISO/IEC 27002:2022 provides best-practice information security controls to help organizations select, implement, and manage protections for information assets.
ISO/IEC 27017 provides cloud-specific security controls to help organizations protect data and manage cloud-related risks.
ISO/IEC 27701 extends ISO/IEC 27001 to help organizations manage privacy and protect personally identifiable information.
Frequently Asked Questions For New Zealand NZISM 3.6 (New Zealand Information Security Manual)
NZISM is used to provide comprehensive information security requirements and guidance for New Zealand government agencies and related organizations. It sets standards for managing security risks, implementing cybersecurity controls, and safeguarding sensitive government data across digital systems.
NZISM compliance is mandatory for New Zealand government agencies and organizations handling sensitive government information. Compliance is enforced through government policy and oversight by the Government Communications Security Bureau (GCSB).
NZISM applies to all New Zealand government departments, agencies, and any contractors or third parties managing official or classified government information. Its scope includes the protection of information, systems, infrastructure, and supporting services that process or store government data.
NZISM specifies security controls such as access management, network security, data protection, incident response, secure configuration, and monitoring. Organizations are required to assess and implement controls appropriate to the classification and sensitivity of their information assets.
Organizations should integrate NZISM requirements into their risk management processes, security policies, and operational procedures. This typically involves conducting risk assessments, performing security control gap analyses, and regularly reviewing operational practices for alignment with NZISM controls.
NZISM aligns with international standards such as ISO 27001 and NIST, providing a national context tailored for New Zealand government needs. It often references or complements controls from these frameworks, allowing organizations to leverage existing best practices when achieving NZISM compliance.
Ongoing compliance with NZISM requires continuous risk assessments, regular reviews of security controls, incident reporting, and maintaining records of compliance activities. Agencies are subject to periodic internal and external audits to validate adherence to NZISM standards.
SmartSuite can help organizations operationalize NZISM by centralizing management of cybersecurity policies, tracking risk assessments, and documenting control implementation. It enables efficient collection of compliance evidence, facilitates audit readiness through automated reporting, and helps security teams monitor and maintain NZISM requirements across the organization.
Put CRI Profile into action with SmartSuite
Map controls, collect evidence, run assessments, manage remediation, and report readiness - all from a single connected system.