Is New Zealand's NZISM post-quantum guidance binding?

No. All seven controls in section 2.4.13 use "SHOULD" compliance language -- NZISM's own advisory, non-mandatory tier -- with no penalty or binding force attached to any of them.

Does New Zealand require a cryptographic inventory?

Two separate ones, in substance, though advisory rather than mandatory. Control C.02 asks agencies to inventory sensitive and critical datasets requiring extended protection (the harvest-now-decrypt-later risk set). Control C.03 separately asks for an inventory of systems using cryptographic technologies generally. Two further controls direct agencies to classify which inventoried systems are quantum-vulnerable and prioritize them for transition.

Are any post-quantum algorithms approved for use in New Zealand government systems?

No, as of NZISM v3.9. The section states directly: "Currently there are no post-quantum cryptographic systems approved for use in the NZISM, however there are actions that agencies can undertake to prepare for the time when such systems are approved."

Does New Zealand's guidance extend beyond government agencies?

No. NZISM is New Zealand's government information security manual; its scope is agencies, not the private sector or critical infrastructure generally.

pqccbomnew-zealandgcsbnzism

New Zealand's Security Manual Wants Two Separate Cryptographic Inventories, Not One

NZISM's quantum-preparation section splits the inventory requirement in two -- sensitive long-lived datasets, and systems using cryptography -- with seven numbered controls and a 2-3 year transition window once standards exist. All of it advisory.

PQC Security EditorialOctober 18, 20264 min read

Most government cryptographic-inventory guidance asks for one list: find your vulnerable systems. New Zealand's NZISM asks for two, built in a specific order, before it even gets to prioritization.

Two inventories, not one

NZISM (New Zealand Information Security Manual) version 3.9, November 2025, contains a dedicated section, "2.4. Preparation for Post-Quantum Cryptography," maintained by GCSB (Government Communications Security Bureau). Its seven numbered controls, all under compliance tier "SHOULD," build a sequence rather than a single ask:

"2.4.13.C.02 [CID:7207]: Agencies SHOULD maintain an inventory of sensitive and critical datasets that must be secured for an extended amount of time. This will ensure datasets that may be at risk now and decrypted once a cryptographically relevant quantum computer is available are not secured solely through the use of quantum vulnerable cryptography."

That's a data-centric inventory, built specifically around the harvest-now-decrypt-later risk: what information needs to stay confidential for years, regardless of which system currently protects it. A separate control asks for something structurally different:

"2.4.13.C.03 [CID:7208]: Agencies SHOULD conduct an inventory of systems using cryptographic technologies to determine the potential size and scope of future transition work once post-quantum cryptographic systems become available."

That's a system-centric inventory -- not what needs protecting, but what's currently doing the protecting. Most PQC guidance on this tracker asks for one or the other, usually the second. NZISM asks for both, which makes sense once you see where they're headed: control C.04 directs agencies to cross-reference the two, identifying which inventoried systems rely on public-key cryptography and flagging them as quantum-vulnerable in risk assessments. Controls C.05 and C.06 then set prioritization criteria -- asset value, sensitivity of protected information, dependency relationships with other systems, and required protection duration. Control C.07 closes the sequence: using the inventory and prioritization work, develop an actual transition plan once a post-quantum standard is published.

That's a genuinely more structured inventory methodology than most national guidance offers -- two distinct, purpose-built data sets feeding a defined prioritization and planning process, each step with its own control ID.

The deadline that isn't one yet

NZISM doesn't set a fixed migration year, and it's explicit about why: "Currently there are no post-quantum cryptographic systems approved for use in the NZISM." You can't set a deadline to migrate to something that doesn't officially exist yet in your own standard. What it offers instead is a conditional window:

"When standards for quantum-resistant public key cryptography become available, GCSB may deprecate or withdraw support for existing classical cryptographic standards. Agencies should therefore be prepared to transition away from these algorithms possibly in the next 2-3 years, even though the standards to migrate to are still to be developed."

That's a real, if soft, planning signal -- once GCSB approves a standard, agencies should expect roughly 2-3 years before classical algorithm support might be withdrawn. It's not a date on a calendar, but it's more specific than most "begin planning" language elsewhere on this tracker, because it attaches an actual duration estimate to the eventual transition.

What's still missing

Every control uses "SHOULD," NZISM's advisory compliance tier -- no penalty, no binding force, no enforcement mechanism tied to any of the seven controls. Scope is government agencies only; nothing in the section extends to New Zealand's private sector or critical infrastructure generally. And despite the detailed inventory structure, no specific algorithm is named yet -- agencies are told to prepare, inventory, and prioritize, without a target standard to prepare for, because GCSB hasn't approved one.

What to do with this

If you're a New Zealand government agency, the two-inventory structure here is worth adopting as methodology even ahead of any eventual mandate -- separating "what needs long-term protection" from "what's currently providing that protection" is a cleaner analytical split than a single combined inventory, and it's exactly the kind of groundwork control C.07's eventual transition plan will need. The 2-3 year window, soft as it is, is a real enough signal to start that inventory work now rather than waiting for GCSB to approve a standard first.

The New Zealand country page tracks the current NZISM section with its primary source, independently verified against the primary PDF.

Frequently asked questions

Does New Zealand have post-quantum cryptography guidance?: Yes, since January 2022, substantially expanded in the current version. NZISM (New Zealand Information Security Manual) version 3.9, November 2025, contains a dedicated section, "2.4. Preparation for Post-Quantum Cryptography," maintained by GCSB (Government Communications Security Bureau), with seven numbered controls.
Is New Zealand's NZISM post-quantum guidance binding?: No. All seven controls in section 2.4.13 use "SHOULD" compliance language -- NZISM's own advisory, non-mandatory tier -- with no penalty or binding force attached to any of them.
Does New Zealand require a cryptographic inventory?: Two separate ones, in substance, though advisory rather than mandatory. Control C.02 asks agencies to inventory sensitive and critical datasets requiring extended protection (the harvest-now-decrypt-later risk set). Control C.03 separately asks for an inventory of systems using cryptographic technologies generally. Two further controls direct agencies to classify which inventoried systems are quantum-vulnerable and prioritize them for transition.
What is New Zealand's PQC migration timeline?: No fixed date, but a specific transition window: "Agencies should therefore be prepared to transition away from these algorithms possibly in the next 2-3 years, even though the standards to migrate to are still to be developed." That's explicitly conditional -- the clock starts once a post-quantum standard is actually approved for NZISM use, which hadn't happened as of the November 2025 version.
Are any post-quantum algorithms approved for use in New Zealand government systems?: No, as of NZISM v3.9. The section states directly: "Currently there are no post-quantum cryptographic systems approved for use in the NZISM, however there are actions that agencies can undertake to prepare for the time when such systems are approved."
Does New Zealand's guidance extend beyond government agencies?: No. NZISM is New Zealand's government information security manual; its scope is agencies, not the private sector or critical infrastructure generally.