New Zealand

Computer Emergency Response Team (CERT) Top 10 Controls

1. Patching
2. Multi Factor Authentication
3. Use a password manager
4. Configure Logging and Alerting
5. Asset Lifecycle Management
6. Implement and test backups
7. Implement application controls
8. Enforce the principle of least privelege
9. Implement network segmentation
10. Set secure defaults for macros

New Zealand Government Communications Security Bureau (GCSB) Information Security Manual (NZISM)

1. Information security governance – roles and responsibilities
2. System Certification and Accreditation
3. Information security documentation
4. Information security monitoring
5. Information Security Incidents
6. Physical Security
7. Personnel Security
8. Infrastructure
9. Communications Systems and Devices
10. Product Security
11. Media and IT Equipment Management, Decommissioning and Disposal
12. Software security

New Zealand Protective Security Requirements

Governance

1. GOV1 – Establish and maintain the right governance
2. GOV2 – Take a risk-based approach
3. GOV3 – Prepare for business continuity
4. GOV4 – Build security awareness
5. GOV5 – Manage risks when working with others
6. GOV6 – Manage security incidents
7. GOV7 – Be able to respond to increased threat levels
8. GOV8 – Assess your capability

Information

1. INFOSEC1 – Understand what you need to protect
2. INFOSEC2 – Design your information security
3. INFOSEC3 – Validate your security measures
4. INFOSEC4 – Keep your security up to date

Personnel

1. PERSEC1 – Recruit the right person
2. PERSEC2 – Ensure their ongoing suitability
3. PERSEC3 – Manage their departure
4. PERSEC4 – Manage national security clearances

Physical

1. PHYSEC1 – Understand what you need to protect
2. PHYSEC2 – Design your physical security
3. PHYSEC3 – Validate your security measures
4. PHYSEC4 – Keep your security up to date

NZ GOVT GCDO/GCIO 105 – Risk assessment for public cloud services

1. Value, Criticality and Sensitivity of Information
2. Data Sovereignty
3. Privacy
4. Governance
5. Confidentiality
6. Data Integrity
7. Availability
8. Incident Response and Management