NZISM
New Zealand Information Security ManualA primary catalogue for government security assessments. Look up controls by identifier and assess against the baseline appropriate to your engagement.
Frameworks & instruments
Any control framework.
Your applicable privacy rules.
AIS adapts to your security and privacy requirements. Incorporate established standards, your own control policies, and applicable privacy laws or codes as structured, administrator-approved catalogues and instruments. The examples below are a starting point, not a closed list.
Security assessment
Control catalogues
Search and interpret requirements, plan validation and record the supporting evidence.
Security workflowNIST SP 800-53
Security and privacy controlsSearch by control family and identifier, then use the assessment workflow to record validation and findings.
ISO/IEC 27001 & 27002
Information security management and controlsAssess information security controls for organisations working with ISO-based security management programmes.
Andean Control Catalogue
Built by Andean Security ConsultingA proprietary catalogue tailored to New Zealand and Pacific government contexts.
SANS
Security policy templates and guidanceUse the configured SANS catalogue to inform policy interpretation and assessment requirements.
PSR
Protective Security RequirementsInclude governance, personnel and physical security policy requirements alongside information security work.
Your catalogues
Internal policies and tailored baselinesIncorporate any control framework or internal control policy as a structured catalogue. Administrators register and approve it; assessors select the assessment catalogue at project creation where enabled.
Privacy assessment
Privacy frameworks & instruments
Choose a built-in framework, then add the requirements relevant to the assessment. Questions, screening and reports follow the selected framework.
GDPR support covers screening and DPIA assessment work. The Privacy Principles Framework uses Andean’s own wording. It is not the ISO standard, is not endorsed by ISO or IEC, and does not establish conformity with a standard or compliance with any law. Organisations should hold licensed copies of the referenced standards.
Privacy workflowNew Zealand
Privacy Act 2020Run privacy threshold and impact assessments against the New Zealand baseline, including the Biometric Processing Privacy Code 2025 where applicable.
GDPR
DPIA screening & assessmentScreen for the need for a DPIA, record the relevant supervisory-authority context, and develop the assessment with necessity, proportionality, DPO advice and consultation in view.
Australia
Privacy Act 1988 & APPsAssess against the Australian Privacy Principles using an agency or organisation context. Agency assessments also incorporate the Australian Government Agencies Privacy Code 2017.
Privacy Principles Framework
Based on ISO/IEC 29100:2024Use eleven privacy principles expressed in Andean’s own wording for a jurisdiction-neutral assessment. Principle references also include AIS mappings to ISO/IEC 27701:2025.
Additional privacy instruments
Your laws, codes, standards & internal policiesSupplement the selected framework with administrator-approved instruments and custom rules. The Privacy Officer determines which add-ons apply; AIS does not automatically filter them by jurisdiction.
Method, not a compliance guarantee
Support the process.
Keep the decision accountable.
AIS supports point-in-time security assessments, accreditation, findings remediation and system recertification within FISMA-aligned assurance processes. This support does not constitute a certification or guarantee an approval outcome.
Built-in privacy frameworks ship with AIS. Administrators set the default and can allow assessors to choose a framework at project creation. Additional catalogues and instruments require preparation and approval. Privacy reassessments retain the predecessor’s framework, and exports identify the assessment instrument and version, noting that other instruments may apply.
See it with your team
Bring your assessment.
We’ll show you the workflow.
A 30-minute walkthrough tailored to your frameworks, your team and the work you need to deliver.