ISM control lookup / Topic

Guidelines for cyber security documentation

11 controls · September 2026 edition

• ISM-0039 · Cyber security strategy

  A cyber security strategy is developed, implemented and maintained.

• ISM-0041 · System security plan

  Systems have a system security plan that includes an overview of the system (covering the system’s purpose, the system boundary and how the system is managed) as well as an annex that covers applicable security controls from this document and any additional security controls that have been identified and implemented.

• ISM-0043 · Cyber security incident response plan

  Systems have a cyber security incident response plan that covers the following:

• ISM-0047 · Approval of cyber security documentation

  Organisational-level cyber security documentation is approved by the chief information security officer while system-specific cyber security documentation is approved by the system’s authorising officer.

• ISM-0888 · Maintenance of cyber security documentation

  Cyber security documentation is reviewed at least annually and includes a ‘current as at [date]’ or equivalent statement.

• ISM-0912 · Change and configuration management plan

  Systems have a change and configuration management plan that includes:

• ISM-1163 · Continuous monitoring plan

  Systems have a continuous monitoring plan that includes:

• ISM-1563 · Security assessment report

  At the conclusion of a security control assessment for a system, a security assessment report is produced by the assessor and covers:

• ISM-1564 · Plan of action and milestones

  At the conclusion of a security control assessment for a system, a plan of action and milestones is produced by the system owner.

• ISM-1602 · Communication of cyber security documentation

  Cyber security documentation, including notification of subsequent changes, is communicated to all stakeholders.

• ISM-1739 · Approval of cyber security documentation

  A system’s security architecture is approved prior to the development of the system.