New Zealand NZISM

NZ Information Security Manual: software asset register, supplier management, software integrity.


Short name	NZISM
Region	Asia-Pacific
Country or scope	New Zealand
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NZISM

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for NZISM.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for NZISM and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NZISM-ASSET-REG` Software Asset Register	Agencies must maintain registers of their systems and software assets, i.e. an inventory of components in use (NZISM asset management and documentation controls)	Scan
`NZISM-PATCH` Product Patching and Updating	Software must be kept patched and up to date, which requires knowing the installed version of each component (NZISM product patching and updating chapter)	Scan
`NZISM-SUPPLIER` Supplier and Outsourcing Management	Risks from suppliers and outsourced services must be identified and managed, presupposing named suppliers for software components (NZISM supplier relationships and outsourcing controls)	Scan
`NZISM-INTEGRITY` Software Integrity Assurance	Software acquired and installed must be verifiable as authentic and unmodified, supported by integrity hashes (NZISM software security and integrity controls)	Scan
`NZISM-VULN` Vulnerability Identification	Agencies must identify vulnerabilities affecting their systems, requiring components identifiable against vulnerability sources via PURL or CPE (NZISM vulnerability management controls)	Scan
`NZISM-DOC` System Documentation	System security documentation must be maintained and current, satisfied by dated, identifiable SBOM documentation (NZISM information security documentation chapter)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`NZISM-CH5-1`	Establish an Information Security Policy Framework
`NZISM-CH5-2`	Classify Government Information Assets
`NZISM-CH6-1`	Screen Personnel with Access to Sensitive Information
`NZISM-CH14-1`	Encrypt Data in Transit Using Approved Algorithms
`NZISM-CH14-2`	Encrypt Data at Rest for Sensitive Classifications
`NZISM-CH17-1`	Implement Perimeter and Internal Network Security Controls
`NZISM-CH17-2`	Monitor Network Traffic for Threats
`NZISM-CH19-1`	Control Access to Systems Based on Least Privilege
`NZISM-CH20-1`	Manage Vulnerabilities in Government Systems
`NZISM-CH21-1`	Respond to Information Security Incidents
`NZISM-CH22-1`	Conduct Business Continuity Planning
`NZISM-CLOUD-1`	Assess Cloud Services Against NZISM Requirements

Policy templates

Written for NZISM:

Government Information Security Policy Framework (NZISM)
Cryptography and Network Security Policy (NZISM)

And 22 from the standard set, adapted to NZISM.