Compliance / By country / NZISM
New Zealand Information Security Manual (NZISM) and Microsoft 365
New Zealand government's information-security manual. Siemserva by Senserva maps 239+ Microsoft 365 and Entra ID checks to the areas NZISM emphasizes, so a scan of your tenant doubles as evidence.
What NZISM is
The NZISM is the New Zealand government's information-security manual, published by the GCSB. Its identity, access-control, and logging requirements carry the same overlap with Microsoft 365 and Entra ID as the Australian ISM.
How Siemserva maps to NZISM
NZISM asks for strong identity, access control, and monitoring. Siemserva evidences those areas with the checks below, each ranked by Severity and checked against your own tenant:
Identity and access management (60 checks)
Conditional Access (60 checks)
Privileged access (PIM) (34 checks)
Multi-factor authentication (42 checks)
Auth User Not MFA RegisteredAuth Microsoft Authenticator Authentication Method In Use But Not Allowed By UserAuth Password Authentication Method In Use But Not Allowed By Senserva Security ManagerAuth Passwordless Microsoft Authenticator Authentication Method In Use But Not Allowed By UserAuth Require Passwordless But Its Not Used By UserAuth Software Oath Authentication Method In Use But Not Allowed By UserLogging and audit (43 checks)
See every check with its Severity and remediation in the checks catalog, or the per-control detail in the control reference.
NZISM and Microsoft 365: common questions
Does NZISM apply to Microsoft 365?
New Zealand Information Security Manual (NZISM) does not name Microsoft 365 specifically, but its identity, access-control, and logging requirements are met (or missed) in your Microsoft 365 and Entra ID configuration. That is where Siemserva checks provide the evidence.
How does Siemserva map to NZISM?
Siemserva runs 239+ Microsoft 365 and Entra ID checks across the areas NZISM emphasizes, multi-factor authentication, Conditional Access, privileged access, and logging, ranks the gaps by Severity, and produces audit-ready evidence. It is evidence, not an official mapping or certification.
Is this an official NZISM certification?
No. Senserva is not an assessor and issues no certifications. It provides the configuration evidence, Severity ranking, and remediation that make an assessment defensible. Confirm requirements with your assessor or regulator.
More: the frameworks crosswalk, Microsoft 365 compliance by country, and the audit evidence guide.