New Zealand Protective Security Requirements (PSR) compliance software
Assess and evidence the Protective Security Requirements across GOVSEC, PERSEC, INFOSEC and PHYSEC — ready for annual PSR assurance reporting.
What NZ PSR requires
The Protective Security Requirements set the New Zealand Government's expectations for managing security across four domains: security governance (GOVSEC), personnel security (PERSEC), information security (INFOSEC) and physical security (PHYSEC). The PSR function is hosted by the New Zealand Security Intelligence Service.
Mandated agencies must apply the PSR and report annually on their security capability through the PSR assurance process; the wider state sector is encouraged to adopt it as good practice. The requirements emphasise risk-based security leadership — a Chief Security Officer accountable to the chief executive — rather than checkbox compliance.
The PSR anchors New Zealand's wider security ecosystem: the NZISM provides detailed technical controls for INFOSEC, and the new Minimum Cyber Security Standards report through PSR assurance. Managing them together on one platform keeps evidence consistent.
Who it applies to
- PSR-mandated New Zealand government agencies
- Crown entities adopting the PSR as expected practice
- Suppliers handling government information under contract
- State-sector organisations aligning security governance to PSR
At a glance
- Owner: PSR function hosted by NZSIS
- Domains: GOVSEC, PERSEC, INFOSEC, PHYSEC
- Technical companion: NZISM for detailed information security controls
- Reporting: Annual PSR assurance reporting to government
How GRCLens supports NZ PSR
NZ PSR runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Domain-by-domain assessment
PSR requirements pre-loaded across the four security domains, assessed with status, owners, comments and dated evidence.
Assurance-report evidence
Maintained assessments provide the defensible record behind annual PSR assurance reporting and CSO attestation.
Connected standards
INFOSEC requirements link to NZISM-aligned controls, and MCSS obligations report from the same evidence base.
Owner accountability
Assign requirements to the CSO, CISO and business owners the PSR expects to be accountable.
NZ PSR frequently asked questions
Who must apply the PSR?
PSR-mandated agencies must apply the requirements and report annually; other state-sector organisations are encouraged to adopt them as good practice, and suppliers are often bound through contracts.
How does the PSR relate to the NZISM?
The PSR sets policy-level requirements; the NZISM supplies the detailed technical controls for information security. GRCLens keeps the two connected so INFOSEC evidence serves both.
Does GRCLens support PSR annual reporting?
The platform maintains requirement-level status, owners and artefacts year-round, giving the evidence base your annual PSR assurance report and attestation draw on.
Can PSR and MCSS be managed together?
Yes. The Minimum Cyber Security Standards report through PSR assurance, and GRCLens runs both from a shared evidence model.
One platform, many obligations
Talk to us about NZ PSR
Security Solution Consultants provides NZ protective security advisory alongside the platform, so you can combine tooling with hands-on expertise.
Contact us