UPDATED: 5.30PM Problems have been found in the way the SIS handles its security vetting work.

The Inspector-General of Security and Intelligence Cheryl Gwyn said it can be viewed by too many people within the Security Intelligence Service and she wants security tightened.

Her investigation has found shortcomings in SIS practice that don't meet standard data protection requirements.

They include; electronic records for security clearance holders being accessible to 60 or so SIS staff at any time, despite standard practice suggesting such access be more strictly limited.

Also identified is a lack of specific record keeping for who was accessing such files and when.

She said the spy should only have access to the files which contain personal information while they're working on them and only while they're still active.

She's described it as a serious short coming which is now being rectified by the spy agency.

SIS and GCSB Minister Chris Finlayson said vetting was an issue that was raised with him last year by the SIS Director, who noted procedures were out of date.

"It's a constant ongoing period of reform for the SIS and I'm very happy that the report is out, but to a certain extent, it's almost after the event because the SIS is working on this stuff anyway".

Mr Finlayson said people can have confidence in the way the SIS is handling their vetting information.

"Ah yes I do believe I can say that, and I'm what I want to say is there are going to be further improvements made".

But Green Party Co-Leader Metiria Turei said the Minister can't make that assurance.

"The inspector general just put out a report saying it has been used for purposes for which it was not given. For counter intelligence, for example".

Ms Turei is concerned at the report's findings, particularly at the lack of controls on who, within the SIS, could access such personal information.

"It is the largest body of such private information, held by any New Zealand Government department, and that department doesn't have any proper controls or policy on how to manage the access, and it's allowing people to use it for purposes it wasn't given".