Do agencies have to have a security policy in place to join GSN?
The GSN does place certain expectations on participating agencies, but the question of security policy (and related security risk assessment) relates to wider agency obligations under Security in Government Systems (SIGS) and NZSIT-400. Joining the GSN will assist an agency to comply with key aspects, but ultimate accountability for self-assessment of sensitivity of information and policy and risk assessment remains with the agency.
