Map your controls to NZISM and evidence them with less effort

The NZISM is the New Zealand Information Security Manual, the New Zealand Government's manual on information assurance and information systems security. It is published by the Government Communications Security Bureau through its National Cyber Security Centre. It sets out controls across governance, physical and personnel security, infrastructure, cryptography, networks, gateways, data management and cloud, with each control graded MUST or SHOULD.

NZISM v3.6, released in September 2022, added a new Chapter 23 on Public Cloud Security, a new section on inverse split tunnel VPNs, updates to DMARC and DKIM guidance in section 15.2 and language modernisation throughout. The cloud chapter covers security concepts, governance and assurance, identity and access control, data protection, and logging and alerting in public cloud.

No. Version 3.6 has been superseded. The GCSB released v3.7 in February 2024, v3.8 in September 2024 and v3.9 in May 2025, which renamed Chapter 16 to Authentication and Access Controls and updated incident reporting in Chapter 7. Organisations should check the official NZISM site for the version they are expected to follow.

New Zealand government agencies apply the NZISM as the technical information security standard supporting the Protective Security Requirements. Agency heads are accountable for their systems, which are certified and accredited against it. Suppliers and cloud providers handling government information are often required to align with it through contracts, and many other organisations use it voluntarily as a baseline.

The NZISM does not set fines. Instead, agencies must assess and document any non-compliance, with the level of authority needed to approve it depending on whether the control is a MUST or a SHOULD. Unaddressed gaps can affect system certification and accreditation, and expose the agency to the security risks the controls are designed to reduce.

ISO 27001 is an international, certifiable management system standard, while the NZISM is a detailed New Zealand Government control manual with technical requirements. Many controls overlap, such as access control, cryptography, incident management and supplier security, so evidence gathered for one can support the other. ISO 27001 certification alone does not show NZISM compliance.

It depends on the number of systems in scope, their classification levels and how mature your existing controls are. Agencies with established security programmes may only need to close specific gaps, while others will need policies, technical changes and a certification and accreditation process. A gap assessment against the relevant chapters is the usual starting point.

Yes. OneClickComply supports NZISM v3.6 today. Your connected tools supply evidence against the mapped controls, and that evidence also counts towards other frameworks you follow, such as ISO 27001. Our in-house audit team can help you interpret MUST and SHOULD controls. OneClickComply does not certify or accredit systems; that remains with your agency's accreditation process.