Meet HISF supplier requirements for Health New Zealand with confidence

The HISF Guidance for Suppliers is HISO 10029.4, the supplier segment of New Zealand's Health Information Security Framework, published by Health New Zealand | Te Whatu Ora. It sets out 68 cyber security requirements, numbered HSUP01 to HSUP68, for organisations that provide on-premises or cloud services to the health sector, with detailed implementation guidance for each requirement.

It applies to suppliers of services or products to the New Zealand health sector, and their sub-contractors. Examples named in the guidance include software resellers, medical device resellers or implementors, internet service providers, outsourced service providers and SaaS providers. Health New Zealand expects its third parties to align and conform with the HISF, and assesses their cyber posture against it.

No. Health New Zealand states that the HISF does not have a legislative mandate. In practice it is a contractual and assurance expectation: Health New Zealand uses adoption of, alignment with and maturity against the HISF as the main measures when evaluating suppliers' cyber posture. Suppliers must still meet legal duties such as the Privacy Act 2020 and the Health Information Privacy Code 2020.

The 68 HSUP requirements are grouped under the five HISF functional processes: Plan, Identify, Protect, Detect and Respond. The detailed guidance then organises them by topic, including information security policy, human resource security, asset lifecycle, incident management, business continuity, cryptography, identity and access management, cloud security, change and patch management, backups, data leakage prevention and logging and monitoring.

Holding ISO 27001 certification gives a strong foundation and you may already meet many HISF requirements, according to Health New Zealand's supplier FAQ. HISF is not the same as ISO 27001, though, so certified organisations should compare their controls with the 68 HSUP requirements and close any gaps, for example around health-specific incident reporting, cloud assurance and supplier agreements.

The current edition is HISO 10029.4:2025, released by Health New Zealand in April 2025. It replaced the 2023 edition, HISO 10029.4:2023. Both editions sit beneath the core framework document, HISO 10029:2022 Health Information Security Framework, which defines the segments, building blocks, functional processes and principles that the supplier guidance builds on.

Health New Zealand describes a three-step approach: read the core HISO 10029:2022 framework, read the supplier guidance and understand its requirements, then use HISF tools, templates and approved materials to meet them. Practically, that means assessing your current controls against each HSUP requirement, fixing gaps, documenting policies and keeping evidence that controls operate effectively.

Yes. OneClickComply supports the HISF Guidance for Suppliers today. Controls you already meet for frameworks such as ISO 27001 count towards HISF, and OneClickComply helps you collect evidence, generate policies and monitor controls continuously. Our in-house auditors can advise on gaps before an assessment. OneClickComply does not certify HISF conformance.