1.1.30. An information asset is any information or related equipment that has value to an agency or organisation. This includes equipment, facilities, patents, intellectual property, software and hardware. Information Assets also include services, information, and people, and characteristics such as reputation, brand, image, skills, capability and knowledge. Information Assurance (IA) 1.1.31. Confidence in the governance of information systems and that effective measures are implemented to manage, protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. Information Security 1.1.32. Although sometimes described as cyber security, Information security is considered a higher level of abstraction than cyber security relating to the protection of information regardless of its form (electronic or physical). The accepted definition of information security within government is: “measures relating to the confidentiality, availability and integrity of information”. 1.1.33. A number of specialised security areas contribute to information security within government; these include: physical security, personnel security, communications security and information and communications technology (ICT) security along with their associated governance and assurance measures. Information Systems 1.1.34. The resources and assets for the collection, storage, processing, maintenance, use sharing, dissemination, disposition, display, and transmission of information. This includes necessary and related services provided as part of the information system, for example; Telecommunication or Cloud Services. Information Systems Governance 1.1.35. An integral part of enterprise governance consists of the leadership and organisational structures and processes to ensure that the agency’s information systems support and sustain the agency’s and Government’s strategies and objectives. Information Systems Governance is the responsibility of the Agency Head and the Executive team. Secure Area 1.1.36. In the context of the NZISM a secure area is defined as any area, room, group of rooms, building or installation that processes, stores or communicates information classified CONFIDENTIAL, SECRET, TOP SECRET or any compartmented or caveated information at these classifications. A secure area may include a SCIF (see below). The physical security requirements for such areas are specified in the Protective Security Requirements (PSR) Security Zones. Security Posture 1.1.37. The Security Posture of an organisation describes and encapsulates the security status and overall approach to identification and management of the security of an organisation’s networks, information, systems, processes and personnel. It includes risk assessment, threat identification, technical and non-technical policies, procedures, controls and resources that safeguard the organisation from internal and external threats. Sensitive Compartmented Information Facility (SCIF) 1.1.38. Any accredited area, room, or group of rooms, buildings, or installation where Sensitive Compartmented Information (SCI) is stored, used, discussed, processed or communicated. The Accreditation Authority for a SCIF is the Director GCSB or formal delegate. System Owner 1.1.39. A System Owner is the person within an agency responsible for the information resource and for the maintenance of system accreditation. This may include such outsourced services such as telecommunications or cloud. Their responsibilities are described in more detail in Section 3.4 – System Owners. Interpretation of controls Controls language 1.1.40. The definition of controls in this manual is based on language as defined by the Internet Engineering Task Force (IETF)’s Request For Comment (RFC) 2119 to indicate differing degrees of compliance. Applicability of controls 1.1.41. Whilst this manual provides controls for specific technologies, not all systems will use all of these technologies. When a system is developed, the agency will determine the appropriate scope of the system and which controls within this manual are applicable. 1.1.42. If a control within this manual is outside the scope of the system then non-compliance processesdo not apply. However, if a control is within the scope of the system yet the agency chooses not to implement the control, then they are required to follow the non-compliance procedures as outlined below in order to provide appropriate governance and assurance. 1.1.43. The procedures and controls described in the NZISM are designed, not only to counter or prevent known common attacks, but also to protect from emerging threats. Identification and Selection of controls 1.1.44. In all cases controls have been selected as the most effective means of mitigating identified risks and threats. Each control has been carefully researched and risk assessed against a wide range of factors, including useability, threat levels, likelihood, rapid technology changes, sustainability, effectiveness and cost. Controls with a “MUST” or “MUST NOT” requirement 1.1.45. A control with a “MUST” or “MUST NOT” requirement indicates that use, or non-use, of the control is essential in order to effectively manage the identified risk, unless the control is demonstrably not relevant to the respective system. These controls are baseline controls, sometimes described as systems hygiene controls. 1.1.46. The rationale for non-use of baseline controls MUST be clearly demonstrated to the Accreditation Authority as part of the certification process, before approval for exceptions is granted. MUST and MUST NOT controls take precedence over SHOULD and SHOULD NOT controls. Controls with a “SHOULD” or “SHOULD NOT” requirement 4 Version_3.5__January-2022