Snowflake completes NZISM Restricted assessment on AWS in New Zealand
Snowflake says it has completed an independent third-party assessment against the New Zealand Information Security Manual (NZISM) for its deployment in the Amazon Web Services (AWS) Auckland region. According to the company, the result confirms alignment with the New Zealand government's Restricted level control requirements.
- Snowflake completed an independent third-party NZISM assessment for its AWS Auckland deployment.
- The company says the result confirms alignment with New Zealand's Restricted level control requirements.
- Assessment artifacts such as control mappings and risk documentation are meant to speed up agency accreditation and ATO decisions.
- Snowflake also cites SOC 2 Type 2, ISO 27001, PCI DSS and ISO 42001 certification for AI management systems.
What the assessment covers
The assessment was carried out by an independent third-party assurance provider that, according to Snowflake, has experience conducting assessments in the region. It evaluated Snowflake's controls against identified requirements in the NZISM.
Snowflake says the outcome leaves it better positioned to support government agencies that need services aligned with the Restricted security requirements. The announcement was published on the company's blog by Glenn Powell, Industry Principal for Global Public Sector, together with Dillon Finskars, Senior Compliance and Risk Analyst.
Faster accreditation for agencies
Snowflake argues the assessment shortens procurement and deployment for government customers. Under the Protective Security Requirements (PSR), agencies must complete their own certification and accreditation (C&A) process before granting an authority to operate (ATO).
Because the assessment independently verifies Snowflake's platform-level controls, the company says agencies can avoid the time-consuming effort of full-stack infrastructure audits. Agency CISOs and lead assessors can use Snowflake's assessment artifacts, including control mappings and risk documentation, and concentrate on their own configurations and integrations. Snowflake says this speeds up the C&A timeline and lets accreditation authorities issue ATOs faster and with greater confidence in managing residual risk.
Workloads and wider compliance posture
Snowflake says that with its AWS deployment assessed at the Restricted level, agencies can use the platform for a range of AI and data workloads, including:
- Unifying fragmented data across systems for analysis and reporting
- Secure data sharing and collaboration without unnecessary data movement or duplication
- Decision-making based on trusted, timely insights from governed data
- AI and advanced analytics on a secure and compliance-supporting data foundation
- Scaling with the elasticity and performance needed for modern public sector workloads
The company notes the milestone builds on its existing support for public sector workloads in New Zealand and on its broader compliance posture. That includes SOC 1 Type 2, SOC 2 Type 2, ISO 27001, PCI DSS and, in select deployments, IRAP and FedRAMP. Snowflake also points to certification to the ISO 42001 standard for Artificial Intelligence Management Systems, which it says lets agencies use AI capabilities on its platform backed by recognized standards for AI safety, fairness and accountability.
What it means for New Zealand agencies
For agencies handling sensitive information, the practical effect described by Snowflake is a shorter path to approval and the ability to keep data onshore while adopting analytics and AI. Powell put it this way in the announcement: "Agencies no longer need to choose between onshore data security and innovation."
Agencies still carry responsibility for their own configurations and integrations, and they must complete their own accreditation process. The assessment supplies evidence for the platform layer. Organizations that want details can consult the Snowflake Security Hub, which the company points to for its security and compliance program.