Sign in

NZISM

New Zealand Information Security Manual — NCSC (National Cyber Security Centre, GCSB)

Also known as: NZISM, New Zealand Information Security Manual, NZ Information Security Manual

Official site Official change log Subscribe to NZISM (RSS)

Current version
NZISM v3.9
Published 9 May 2025. source
Status
In force
Next deadline
None announced
Who must comply
New Zealand government agencies and organisations; Crown entities, local government and the private sector are encouraged to use it. source
How it is assessed
Agencies apply the baseline controls and decide on the good-practice controls through their own assessment of residual risk. source
Written by
Published by the National Cyber Security Centre (NCSC), part of the Government Communications Security Bureau (GCSB). source
Enforced by
Not confirmed by an official source yet.
Last change
None recorded yet

The information security manual New Zealand government agencies are expected to follow and, in practice, the one anyone selling them a system is asked to meet: it carries the controls the Protective Security Requirements point to.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. NZISM v3.9 released
  2. NZISM v3.8 released
  3. NZISM v3.7 released

Version history

  1. NZISM v3.9 RevisionCurrent

    Updates to chapter 16, chapter 7, section 11.8 and section 18.2. source

    More
    • Chapter 16 became Authentication and Access Controls, with password controls aligned to industry standards including NIST, passwordless authentication and phishing-resistant multi-factor authentication.
    • Chapter 7 improves guidance on detecting and managing incidents and sets clearer reporting expectations for GCISO-mandated agencies.
    • Section 18.2 introduces WPA3 for wireless networks, with several new controls.
  2. NZISM v3.8 Revision

    Chapter 11 separated Bluetooth from radio frequency and infrared devices, and chapter 15 was updated to improve email security. source

  3. NZISM v3.7 Revision

    One policy change, to section 17.9 Key management, plus editorial changes to sections 1.2 and 2.1 and other minor edits. source

Who it applies to

The NZISM is written for New Zealand government agencies and the vendors and consultants who serve them; other public bodies and private organisations are encouraged to use it.

Government agencies
The NZISM is intended for use by New Zealand government agencies and organisations. source
Encouraged
Crown entities, local government and private sector organisations are also encouraged to use it. source
Suppliers
It is designed for agency security executives and for vendors, contractors and consultants who provide services to agencies. source

How compliance is assessed

Agencies apply the baseline controls and decide on the good-practice controls through their own assessment of residual risk.

Baseline and good practice
The NZISM provides essential or baseline controls plus additional good and recommended practice controls for government agencies. source
Risk-based choice
Each agency decides whether to use good practice controls based on its own assessment of residual information security risk. source

Enforcement and penalties

Not confirmed by an official source yet.

Documents

  1. Standard New Zealand Information Security Manual (NZISM)
  2. Guidance NZISM overview (NCSC)
  3. Guidance NZISM v3.9 release notes (NCSC)

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to NZISM (RSS)