Az Policy Advertizer

16.1.33.C.01.

NZISM_v3.7_16.1.33.C.01.

NZISM v3.7 16.1.33.C.01.

Identification, Authentication and Passwords

16.1.33.C.01. - promote security and accountability within the agency's systems.

Shared

n/a

Agencies MUST NOT use shared credentials to access accounts.

16.1.33.C.02.

NZISM_v3.7_16.1.33.C.02.

NZISM v3.7 16.1.33.C.02.

Identification, Authentication and Passwords

16.1.33.C.02. - promote security and accountability within the agency's systems.

Shared

n/a

Agencies SHOULD NOT use shared credentials to access accounts.

16.1.34.C.01.

NZISM_v3.7_16.1.34.C.01.

NZISM v3.7 16.1.34.C.01.

Identification, Authentication and Passwords

16.1.34.C.01. - promote security and accountability within the agency's systems.

Shared

n/a

If agencies choose to allow shared, non user-specific accounts they MUST ensure that an independent means of determining the identification of the system user is implemented.

16.1.35.C.02.

NZISM_v3.7_16.1.35.C.02.

NZISM v3.7 16.1.35.C.02.

Identification, Authentication and Passwords

16.1.35.C.02. - implement additional authentication factors to enhance security.

Shared

n/a

Agencies SHOULD ensure that they combine the use of multiple methods when identifying and authenticating system users.

16.1.36.C.01.

NZISM_v3.7_16.1.36.C.01.

NZISM v3.7 16.1.36.C.01.

Identification, Authentication and Passwords

16.1.36.C.01. - enhance overall security posture.

Shared

n/a

Agencies MUST NOT allow storage of unprotected authentication information that grants system access, or decrypts an encrypted device, to be located on, or with the system or device, to which the authentication information grants access.

16.1.37.C.01.

NZISM_v3.7_16.1.37.C.01.

NZISM v3.7 16.1.37.C.01.

Identification, Authentication and Passwords

16.1.37.C.01. - enhance overall security posture.

Shared

n/a

Agencies MUST ensure that system authentication data is protected when in transit on agency networks or All-of-Government systems.

16.1.39.C.01.

NZISM_v3.7_16.1.39.C.01.

NZISM v3.7 16.1.39.C.01.

Identification, Authentication and Passwords

16.1.39.C.01. - enhance overall security posture.

Shared

n/a

Where systems contain NZEO or other nationalities releasability marked or protectively marked information, agencies MUST provide a mechanism that allows system users and processes to identify users who are foreign nationals, including seconded foreign nationals.

16.1.39.C.02.

NZISM_v3.7_16.1.39.C.02.

NZISM v3.7 16.1.39.C.02.

Identification, Authentication and Passwords

16.1.39.C.02. - enhance overall security posture.

Shared

n/a

Agencies using NZEO systems SHOULD ensure that identification includes specific nationality for all foreign nationals, including seconded foreign nationals.

16.1.41.C.02.

NZISM_v3.7_16.1.41.C.02.

NZISM v3.7 16.1.41.C.02.

Identification, Authentication and Passwords

16.1.41.C.02. - enhance overall security posture.

Shared

n/a

Agencies MUST NOT: 1. allow predictable reset passwords; 2. reuse passwords when resetting multiple accounts; 3. store passwords in the clear on the system; 4. allow passwords to be reused within eight password changes; and 5. allow system users to use sequential passwords.

16.1.43.C.01.

NZISM_v3.7_16.1.43.C.01.

NZISM v3.7 16.1.43.C.01.

Identification, Authentication and Passwords

16.1.43.C.01. - enhance overall security posture.

Shared

n/a

Agencies SHOULD disable LAN Manager for password authentication on workstations and servers.

16.1.48.C.02.

NZISM_v3.7_16.1.48.C.02.

NZISM v3.7 16.1.48.C.02.

Identification, Authentication and Passwords

16.1.48.C.02. - enhance overall security posture.

Shared

n/a

Agencies SHOULD seek legal advice on the exact wording of logon banners.

16.1.49.C.01.

NZISM_v3.7_16.1.49.C.01.

NZISM v3.7 16.1.49.C.01.

Identification, Authentication and Passwords

16.1.49.C.01. - enhance overall security posture.

Shared

n/a

Agencies SHOULD configure systems to display the date and time of the system user's previous login during the login process.

16.1.50.C.01.

NZISM_v3.7_16.1.50.C.01.

NZISM v3.7 16.1.50.C.01.

Identification, Authentication and Passwords

16.1.50.C.01. - enhance overall security posture.

Shared

n/a

Agencies SHOULD NOT permit the display of last logged on username, credentials or other identifying details.

16.1.50.C.02.

NZISM_v3.7_16.1.50.C.02.

NZISM v3.7 16.1.50.C.02.

Identification, Authentication and Passwords

16.1.50.C.02. - enhance overall security posture.

Shared

n/a

Agencies SHOULD NOT permit the caching of credentials unless specifically required.

16.2.3.C.01.

NZISM_v3.7_16.2.3.C.01.

NZISM v3.7 16.2.3.C.01.

System Access and Passwords

16.2.3.C.01. - enhance overall security posture.

Shared

n/a

Agencies MUST NOT allow access to NZEO information from systems and facilities not under the sole control of the government of New Zealand and New Zealand citizens.

16.2.3.C.02.

NZISM_v3.7_16.2.3.C.02.

NZISM v3.7 16.2.3.C.02.

System Access and Passwords

16.2.3.C.02. - enhance overall security posture.

Shared

n/a

Unless a multilateral or bilateral security agreement is in place, agencies SHOULD NOT allow access to classified information from systems and facilities not under the sole control of the government of New Zealand and New Zealand citizens.

7.2.1

PCI_DSS_v4.0.1_7.2.1

PCI DSS v4.0.1 7.2.1

Restrict Access to System Components and Cardholder Data by Business Need to Know

An access control model is defined and includes granting access as follows: Appropriate access depending on the entity’s business and access needs. Access to system components and data resources that is based on users’ job classification and functions. The least privileges required (for example, user, administrator) to perform a job function

Shared

n/a

Examine documented policies and procedures and interview personnel to verify the access control model is defined in accordance with all elements specified in this requirement. Examine access control model settings and verify that access needs are appropriately defined in accordance with all elements specified in this requirement

7.2.2

PCI_DSS_v4.0.1_7.2.2

PCI DSS v4.0.1 7.2.2

Restrict Access to System Components and Cardholder Data by Business Need to Know

Access is assigned to users, including privileged users, based on: Job classification and function. Least privileges necessary to perform job responsibilities

Shared

n/a

Examine policies and procedures to verify they cover assigning access to users in accordance with all elements specified in this requirement. Examine user access settings, including for privileged users, and interview responsible management personnel to verify that privileges assigned are in accordance with all elements specified in this requirement. Interview personnel responsible for assigning access to verify that privileged user access is assigned in accordance with all elements specified in this requirement

7.2.5

PCI_DSS_v4.0.1_7.2.5

PCI DSS v4.0.1 7.2.5

Restrict Access to System Components and Cardholder Data by Business Need to Know

All application and system accounts and related access privileges are assigned and managed as follows: Based on the least privileges necessary for the operability of the system or application. Access is limited to the systems, applications, or processes that specifically require their use

Shared

n/a

Examine policies and procedures to verify they define processes to manage and assign application and system accounts and related access privileges in accordance with all elements specified in this requirement. Examine privileges associated with system and application accounts and interview responsible personnel to verify that application and system accounts and related access privileges are assigned and managed in accordance with all elements specified in this requirement

7.2.6

PCI_DSS_v4.0.1_7.2.6

PCI DSS v4.0.1 7.2.6

Restrict Access to System Components and Cardholder Data by Business Need to Know

All user access to query repositories of stored cardholder data is restricted as follows: Via applications or other programmatic methods, with access and allowed actions based on user roles and least privileges. Only the responsible administrator(s) can directly access or query repositories of stored CHD

Shared

n/a

Examine policies and procedures and interview personnel to verify processes are defined for granting user access to query repositories of stored cardholder data, in accordance with all elements specified in this requirement. Examine configuration settings for querying repositories of stored cardholder data to verify they are in accordance with all elements specified in this requirement

Sarbanes_Oxley_Act_(1)_2022_1

7.3.1

PCI_DSS_v4.0.1_7.3.1

PCI DSS v4.0.1 7.3.1

Restrict Access to System Components and Cardholder Data by Business Need to Know

An access control system(s) is in place that restricts access based on a user’s need to know and covers all system components

Shared

n/a

Examine vendor documentation and system settings to verify that access is managed for each system component via an access control system(s) that restricts access based on a user’s need to know and covers all system components

Sarbanes Oxley Act 2022 1

PUBLIC LAW

Sarbanes Oxley Act 2022 (SOX)

Shared

n/a

SOC_2

CC6.8

SOC_2_CC6.8

SOC 2 Type 2 CC6.8

Logical and Physical Access Controls

Prevent or detect against unauthorized or malicious software

Shared

The customer is responsible for implementing this recommendation.

Restricts Application and Software Installation — The ability to install applications and software is restricted to authorized individuals. • Detects Unauthorized Changes to Software and Configuration Parameters — Processes are in place to detect changes to software and configuration parameters that may be indicative of unauthorized or malicious software. • Uses a Defined Change Control Process — A management-defined change control process is used for the implementation of software. • Uses Antivirus and Anti-Malware Software — Antivirus and anti-malware software is implemented and maintained to provide for the interception or detection and remediation of malware. • Scans Information Assets from Outside the Entity for Malware and Other Unauthorized Software — Procedures are in place to scan information assets that have been transferred or returned to the entity’s custody for malware and other unauthorized software and to remove any items detected prior to its implementation on the network.

SOC_2

CC8.1

SOC_2_CC8.1

SOC 2 Type 2 CC8.1

Change Management

Changes to infrastructure, data, and software

Shared

The customer is responsible for implementing this recommendation.

Manages Changes Throughout the System Life Cycle — A process for managing system changes throughout the life cycle of the system and its components (infrastructure, data, software, and procedures) is used to support system availability and processing integrity. • Authorizes Changes — A process is in place to authorize system changes prior to development. • Designs and Develops Changes — A process is in place to design and develop system changes. • Documents Changes — A process is in place to document system changes to support ongoing maintenance of the system and to support system users in performing their responsibilities. • Tracks System Changes — A process is in place to track system changes prior to implementation. • Configures Software — A process is in place to select and implement the configuration parameters used to control the functionality of software. • Tests System Changes — A process is in place to test system changes prior to implementation. • Approves System Changes — A process is in place to approve system changes prior to implementation. • Deploys System Changes — A process is in place to implement system changes. • Identifies and Evaluates System Changes — Objectives affected by system changes are identified and the ability of the modified system to meet the objectives is evaluated throughout the system development life cycle. • Identifies Changes in Infrastructure, Data, Software, and Procedures Required to Remediate Incidents — Changes in infrastructure, data, software, and procedures required to remediate incidents to continue to meet objectives are identified and the change process is initiated upon identification. • Creates Baseline Configuration of IT Technology — A baseline configuration of IT and control systems is created and maintained. • Provides for Changes Necessary in Emergency Situations — A process is in place for authorizing, designing, testing, approving, and implementing changes necessary in emergency situations (that is, changes that need to be implemented in an urgent time frame). Additional points of focus that apply only in an engagement using the trust services criteria for confidentiality: • Protects Confidential Information — The entity protects confidential information during system design, development, testing, implementation, and change processes to meet the entity’s objectives related to confidentiality. Additional points of focus that apply only in an engagement using the trust services criteria for privacy: • Protects Personal Information — The entity protects personal information during system design, development, testing, implementation, and change processes to meet the entity’s objectives related to privacy.

CC5.3

SOC_2023_CC5.3

SOC 2023 CC5.3

Control Activities

Maintain alignment with organizational objectives and regulatory requirements.

Shared

n/a

Entity deploys control activities through policies that establish what is expected and in procedures that put policies into action by establishing Policies and Procedures to Support Deployment of Management’s Directives, Responsibility and Accountability for Executing Policies and Procedures, perform tasks in a timely manner, taking corrective actions, perform using competent personnel and reassess policies and procedures.

225

CC6.1

SOC_2023_CC6.1

SOC 2023 CC6.1

Logical and Physical Access Controls

Mitigate security events and ensuring the confidentiality, integrity, and availability of critical information assets.

Shared

n/a

Entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives by identifying and managing the inventory of information assets, restricting logical access, identification and authentication of users, consider network segmentation, manage points of access, restricting access of information assets, managing identification and authentication, managing credentials for infrastructure and software, using encryption to protect data and protect using encryption keys.

127

CC6.2

SOC_2023_CC6.2

SOC 2023 CC6.2

Logical and Physical Access Controls

Ensure effective access control and ensuring the security of the organization's systems and data.

Shared

n/a

1. Prior to issuing system credentials and granting system access, the entity registers and authorizes new internal and external users whose access is administered by the entity. 2. For those users whose access is administered by the entity, user system credentials are removed when user access is no longer authorized.

CC6.3

SOC_2023_CC6.3

404 not found

n/a

CC6.7

SOC_2023_CC6.7

404 not found

n/a

CC7.2

SOC_2023_CC7.2

SOC 2023 CC7.2

Systems Operations

Maintain robust security measures and ensure operational resilience.

Shared

n/a

The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analysed to determine whether they represent security events.

163