Independent NZISM assessment for New Zealand government agencies and the businesses that supply them. We agree the scope, assess the controls, build the evidence, and support you through to the accreditation decision.
Book a certification conversation →Most certification and accreditation work does not fail on technology. It fails on evidence. Controls are in place but undocumented. The system boundary was never agreed, so scope keeps moving. Risk decisions were taken in meetings and never written down. By the time an assessor arrives the work is real but unprovable, and the timeline slips while people reconstruct history.
The other common failure is treating certification and accreditation as a compliance exercise to be survived. Done well, it is the one process that forces a clear statement of what the system is, what it holds, who is accountable, and which risks the organisation has agreed to carry.
Certification is the independent assessment: a structured examination of whether the controls in scope are implemented, operating and documented, measured against the New Zealand Information Security Manual.
Accreditation is the decision that follows: the formal acceptance of residual risk and the authority for the system to operate. That decision belongs to the accrediting authority inside your own organisation, not to us and not to any assessor. Our job is to put that person in a position to decide with their eyes open.
An agreed system boundary, information classification and set of connections, so scope stops moving mid-engagement.
Control by control, with evidence recorded as we go rather than reconstructed afterwards.
The documentation an accrediting authority expects, written to be read rather than filed.
A clear certification report, residual risk stated plainly, and support through to the accreditation decision.
The exact set varies with the system and with your organisation's own process. In most engagements it includes:
NZISM is written for public sector agencies, but it reaches well beyond them. If you provide a system, platform or service that handles government information, the agency's obligations become your requirements, usually arriving as a schedule in the contract or a condition of onboarding. Being assessed before you bid is considerably cheaper than discovering the gap in the middle of a procurement.
An assessment carries weight in proportion to the assessor's distance from the work. Mosaic does not build, run or resell the systems we assess, and we do not sell the controls we recommend. Where we have done earlier advisory work for you, we state it in the report, because an accrediting authority is entitled to know how independent the assessment in front of them actually is.
The New Zealand Information Security Manual is the government's information security standard, issued by the National Cyber Security Centre. It sets out the controls public sector agencies apply to protect official information, and it is the baseline most New Zealand government security requirements trace back to.
Certification is the independent assessment that the controls in scope are implemented and operating. Accreditation is the formal decision to accept the remaining risk and authorise the system to operate. The assessment informs that decision; it does not make it.
The accrediting authority within your own organisation, which is a role held by a senior accountable person rather than by an assessor or an adviser. Our job is to make sure that person has an accurate picture of the residual risk before they sign.
Not directly, but it often applies through your contracts. If you handle government information, or supply a system that does, the agency's NZISM obligations tend to arrive as requirements on you, usually through a contract schedule or an onboarding condition.
The Protective Security Requirements set the government's overall expectations across governance, personnel, physical and information security. NZISM is the detailed information security standard underneath that, covering the technical and procedural controls.
It depends almost entirely on how much evidence already exists. A system with current documentation and a settled boundary can move quickly. One where the controls are real but undocumented takes longer, because in that case the documentation is the deliverable.
We can, and we disclose it in the report. Prior involvement does not automatically disqualify an assessment, but it is a fact the accrediting authority needs in front of them. Where complete separation matters to you, we will say so and recommend a second pair of eyes.
No. We assess, document and advise. The technical work is delivered by your own team or your provider, and we verify the result rather than build it.
A no-obligation conversation about the system, the scope, and what certification and accreditation would realistically take.
Book a certification conversation →