All systems or services classified ■ CONFIDENTIAL and above. All use of High Assurance Cryptographic Equipment (HACE) All systems or services with compartmented or caveated information classified ■ CONFIDENTIAL and above. This is a baseline for any use of High Assurance Cryptographic Equipment (HACE) or the establishment of any compartments or the handling of any endorsed information (see below). The Controls are baseline or “systems hygiene” controls and are essential for the secure use of a system or service. Non-use is high or very high risk and mitigation is essential. If the control cannot be directly implemented and suitable compensating controls MUST be selected to manage identified risks. The Accreditation Authority may grant a Waiver or Exception from a specific requirement if the level of residual risk is within the agency’s risk appetite. Some baseline controls cannot be individually risk managed by agencies without jeopardising multiagency, All-of-Government or international systems and related information. This is a baseline for any use of High Assurance Cryptographic Equipment (HACE) or the establishment of any compartments or the handling of any endorsed information (See below). Control represents good and recommended practice. Non-use may be high risk Non-use of controls is formally recorded, compensating controls selected as required and residual risk formally acknowledged to be within the agency’s risk appetite and agreed and signed off by the Accreditation Authority Agency Head/Chief Executive/Director General (or formal delegate) Accreditation based on work conducted by the agency and authority to operate by the Agency Head. Controls are baseline or “systems hygiene” controls and are essential for the secure use of a system or service. Non-use is high or very high risk and mitigation is essential. If the control cannot be directly implemented and suitable compensating controls MUST be selected to manage identified risks. The Accreditation Authority may grant a Waiver or Exception from a specific requirement if the level of residual risk is within the agency’s risk appetite. Some baseline controls cannot be individually risk managed by agencies without jeopardising multiagency, All-of-Government or international systems and related information. Accreditation based on work conducted by the agency and authority to operate by the Agency Head. Control represents good and recommended practice. Non-use may be high risk Non-use of controls is formally recorded, compensating controls selected as required and residual risk formally acknowledged to be within the agency’s risk appetite and agreed and signed off by the Accreditation Authority. Director GCSB (or formal delegate) “All Classifications” category 1.1.26. The “All Classifications” category is used to describe the applicability of controls for any information that is Official Information or protectively marked UNCLASSIFIED, IN-CONFIDENCE, SENSITIVE, RESTRICTED, CONFIDENTIAL, SECRET or TOP SECRET, including any caveats or releasability endorsements associated with the respective document classification. Compartmented Information 1.1.27. Compartmented information is information requiring special protection through separation or is “compartmented” from other information stored and processed by the agency. Concept of Operations (ConOp) Document 1.1.28. Systems, operations, campaigns and other organisational activities are generally developed from an executive directive or organisational strategy. The ConOp is a document describing the characteristics of a proposed operation, process or system and how they may be employed to achieve particular objectives. It is used to communicate the essential features to all stakeholders and obtain agreement on objectives and methods. ConOps should be written in a non-technical language to facilitate agreement on understanding and knowledge and provide clarity of purpose. ConOp is a term widely used in the military, operational government agencies and other defence, military support and aerospace enterprises. Information 1.1.29. The New Zealand Government requires information important to its functions, resources and classified equipment to be adequately safeguarded to protect public and national interests and to preserve personal privacy. Information is defined as any communication or representation of knowledge such as facts, data, and opinions in any medium or form, electronic as well as physical. Information includes any text, numerical, graphic, cartographic, narrative, or any audio or visual representation. Information Asset 3 Version_3.5__January-2022