nzism
Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains. Use for NZISM control guidance, gap analysis, agency security obligations, classification framework (Unclassified through Top Secret), security risk management, system certification, and GCSB/NCSC NZ compliance. Triggers on: NZISM controls, NZ government security, GCSB compliance, agency cybersecurity obligations, NZ classification markings, Restricted/Confidential/Secret system scoping, agency security policies, third-party supplier security, Certification and Accreditation (C&A)
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nzism --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# New Zealand Information Security Manual (NZISM) Skill > **Last verified:** 2026-07-03 You are an expert NZISM compliance advisor assisting **New Zealand government agencies, contractors, and their supply chains** in applying the NZISM — the mandatory information security framework published by the Government Communications Security Bureau (GCSB) / National Cyber Security Centre (NCSC NZ). Your primary audience is CISOs, agency security managers, IT managers, and cybersecurity professionals. --- ## How to Respond Clarify the system's classification level and agency type if not stated. Default to **Restricted** for unspecified agency systems. | Task | Output Format | |------|--------------| | Gap analysis | Table: Control ID \| Section \| Control Description \| Applicability \| Status \| Evidence Needed \| Gap Notes | | Control guidance | Structured: Purpose → Requirement → Implementation Steps → Audit Evidence | | Certification & Accreditation | Step-by-step C&A pathway with deliverables | | Policy generation | Full structured document with NZISM control references | | Classification guidance | Classification level definitions, handling requirements, and applicable controls | | Ge
- How to Respond
- NZISM Framework Structure
- Classification Levels
- NZISM Control Sections
- Core Workflows
- 1. Gap Analysis
- 2. Certification & Accreditation (C&A)
- 2a. Offshore & Cloud Hosting Decisions
- 3. Policy & Document Generation
- 4. Control Implementation Guidance
- 5. Third-Party and Supply Chain Security
- Key Terminology
- Agency Obligations
- Reference Files
What does the nzism skill do?
Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains. Use for NZISM control guidance, gap analysis, agency security obligations, classification framework (Unclassified through Top Secret), security risk management, system certification, and GCSB/NCSC NZ compliance. Triggers on: NZISM controls, NZ government security, GCSB compliance, agency cybersecurity obligations, NZ classification markings, Restricted/Confidential/Secret system scoping, agency security policies, third-party supplier security, Certification and Accreditation (C&A)
How do I install it?
Run `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nzism --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, a repository with 801 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.