NZISM
Your government buyer asks whether you meet NZISM.
New Zealand agencies follow the New Zealand Information Security Manual, and they ask their suppliers to show the relevant requirements are met. CyberGrape helps you track them, gather the evidence and keep it current.
When it comes up
Start from who is asking.
An agency contract names NZISM
The contract or the procurement documents say the relevant requirements must be met, and you need to show how.
You provide systems, hosting or services to an agency
The agency wants evidence for the systems you run for it, set out for each system rather than for the whole company.
You run systems at different classification levels
Each system has its own level, so the requirements that apply to it differ and need separate reporting.
What the platform does
Track the requirements, hold the evidence, report by system.
Applicability
Which requirements apply is set from the classification level and profile of each system, so you work on the ones that matter for that system.
Certification stages
A system moves through set stages, from draft to assessment to certified and maintained. Each stage change is recorded with who made it and when.
Coverage view
See which requirements are covered, which are not and which evidence supports each one.
Enterprise and system scope
Manage the whole organisation and individual systems side by side, with inherited measures tracked separately from system-specific ones.
Audit trail
Every action is recorded with the person and the time, and the history can be exported for an agency or assessor.
Reports
Certification reports and summaries for the assessing authority, built from the same records you work in.
Certification stages
From first draft to ongoing maintenance.
NZISM certification is not a single event. The platform follows each system through the stages below.
01Initiation
- Draft
- Submitted
- Under review
02Assessment
- Assessment in progress
- Assessment complete
03Certification
- Pending approval
- Certified
- Conditionally certified
04Maintenance
- Active
- Re-certification required
- Expired
Coverage
The areas the platform tracks.
- Information security governance
- Personnel security
- Physical security
- Information security
- Communications security
- System acquisition and development
- Access control
- Incident management
Classification levels from unclassified up to restricted are supported. Anything above that needs extra set-up, so talk to us first.
SMB1001, ISO 27001:2022 and NZISM are supported. NIST CSF 2.0 and ISO 42001 are coming soon. See compliance frameworks
Common questions about NZISM.
The New Zealand Information Security Manual is the New Zealand Government's information security manual. It sets the security requirements agencies follow and is the reference many suppliers are asked to meet.
New Zealand government agencies, and suppliers that provide them with systems, hosting or services. Whether it applies to you depends on your contract and the information you handle, so check with the buying agency.
The platform supports levels from unclassified up to restricted. Which requirements apply is adjusted to the level you select. Anything above that needs extra set-up, so talk to us first.
Yes. The platform supports all three from one evidence library. Where requirements overlap, evidence can support more than one framework.
It depends on the size of the system and the classification level. We do not quote a standard timeframe. The assessment shows your gaps early so you can plan.
No. SMB1001 is published by Dynamic Standards International and was not developed by the New Zealand government or NZCS. NZISM is the New Zealand Government's own manual.
Find out where you stand against NZISM.
Start with the free readiness assessment. It shows where you stand and what to fix first. If we are not the right fit, we will tell you that too.