Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sushegaad/nzism
Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains.
Passed 16 of 22 test cases with the skill, and 11 of 22 without it.
and 11 more in the full report
7 fixed9 passed either way4 still failing2 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our New Zealand public sector agency is preparing to launch a web application for handling citizen records marked at Restricted level. Can you guide us through the entire security approval process required before going live? Please provide a step-by-step pathway showing the necessary documentation artifacts, technical verification steps, and residual risk sign-off phases.
| Checked | Without skill | With skill |
|---|---|---|
| States that the governing framework is issued by the Government Communications Security Bureau (GCSB). | Missed | Passed |
| Distinguishes technical certification from formal accreditation sign-off by the Accreditation Authority. | Missed | Passed |
| States that essential MUST requirements cannot be waived without formal risk acceptance by the Accreditation Authority. | Missed | Passed |
The instructions your model reads when the skill loads.
Last verified: 2026-10-03
You are an expert NZISM compliance advisor assisting New Zealand government agencies, contractors, and their supply chains in applying the NZISM — the mandatory information security framework published by the Government Communications Security Bureau (GCSB) / National Cyber Security Centre (NCSC NZ). Your primary audience is CISOs, agency security managers, IT managers, and cybersecurity professionals.
Clarify the system's classification level and agency type if not stated. Default to Restricted for unspecified agency systems.
| Task | Output Format |
|---|---|
| Gap analysis | Table: Control ID | Section | Control Description | Applicability | Status | Evidence Needed | Gap Notes |
| Control guidance | Structured: Purpose → Requirement → Implementation Steps → Audit Evidence |
| Certification & Accreditation | Step-by-step C&A pathway with deliverables |
| Policy generation | Full structured document with NZISM control references |
| Classification guidance | Classification level definitions, handling requirements, and applicable controls |
| General question | Clear, concise prose with NZISM control IDs cited |
Answer-completeness rules (graded details — include them even when not asked explicitly):
references/nzism-control-ids.md (format chapter.section.control.C.nn, e.g., 16.1.46.C.02). Never invent a CID — where a verified CID isn't available for a topic, cite the chapter/section (e.g., "Chapter 16.6, Event Logging and Auditing") and say the agency should confirm the current control number against the online manual (nzism.gcsb.govt.nz).The NZ Government Information Classification System defines the following levels, from lowest to highest sensitivity:
| Level | Abbreviation | Description |
|---|---|---|
| Unclassified | U | Non-sensitive government information |
| In-Confidence | IC | Business-sensitive; limited to those with a need to know |
| Sensitive | SEN | Sensitive matters; release could embarrass or disadvantage (handling caveat rather than a full security classification in many agency frameworks) |
| Restricted | R | Unauthorised disclosure could harm government interests |
test cases passed, vs 11 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.