ISM control lookup / Topic

Guidelines for cyber security roles

42 controls · September 2026 edition

• ISM-0009 · Protecting systems and their resources

  System owners, in consultation with each system’s authorising officer, identify any supplementary security controls required based upon the unique nature of each system, its operating environment and the organisation’s risk tolerances.

• ISM-0027 · Protecting systems and their resources

  System owners obtain an authorisation to operate for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system from its authorising officer.

• ISM-0714 · Providing cyber security leadership and guidance

  A CISO is appointed to provide cyber security leadership and guidance for their organisation (covering IT and OT).

• ISM-0717 · Overseeing cyber security personnel

  The CISO oversees the management of cyber security personnel within their organisation.

• ISM-0718 · Reporting on cyber security

  The CISO regularly reports directly to their organisation’s board of directors or executive committee on cyber security matters.

• ISM-0720 · Communicating a cyber security vision and strategy

  The CISO oversees the development, implementation and maintenance of a cyber security communications strategy to assist in communicating the cyber security vision and strategy for their organisation.

• ISM-0724 · Overseeing the cyber security program

  The CISO implements cyber security measurement metrics and key performance indicators for their organisation.

• ISM-0725 · Coordinating cyber security

  The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board, comprising key cyber security and business executives, which meets formally and regularly.

• ISM-0726 · Coordinating cyber security

  The CISO coordinates security risk management activities between cyber security and business teams.

• ISM-0731 · Working with suppliers

  The CISO oversees cyber supply chain risk management activities for their organisation.

• ISM-0732 · Receiving and managing a dedicated cyber security budget

  The CISO receives and manages a dedicated cyber security budget for their organisation.

• ISM-0733 · Overseeing cyber security incident response activities

  The CISO is fully aware of all cyber security incidents within their organisation.

• ISM-0734 · Contributing to business continuity and disaster recovery planning

  The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster.

• ISM-0735 · Overseeing cyber security awareness training

  The CISO oversees the development, implementation and maintenance of their organisation’s cyber security awareness training program.

• ISM-1071 · System ownership and oversight

  Each system has a designated system owner.

• ISM-1203 · Protecting systems and their resources

  System owners, in consultation with each system’s authorising officer, conduct a threat and risk assessment for each system.

• ISM-1478 · Overseeing the cyber security program

  The CISO oversees their organisation’s cyber security program and ensures their organisation’s compliance with cyber security policy, standards, regulations and legislation.

• ISM-1525 · System ownership and oversight

  System owners register each system with its authorising officer.

• ISM-1526 · Protecting systems and their resources

  System owners continuously monitor the security of each system, and manage associated cyber threats, security risks and security controls.

• ISM-1587 · Annual reporting of system security status

  System owners report the security status of each system to its authorising officer at least annually.

• ISM-1617 · Overseeing the cyber security program

  The CISO regularly reviews and updates their organisation’s cyber security program to ensure its relevance in addressing cyber threats and harnessing business and cyber security opportunities.

• ISM-1618 · Overseeing cyber security incident response activities

  The CISO oversees their organisation’s response to cyber security incidents.

• ISM-1633 · Protecting systems and their resources

  System owners, in consultation with each system’s authorising officer, determine the system boundary, business criticality, and security and resilience objectives for each system based on an assessment of the impact if it were to be compromised or attacked.

• ISM-1634 · Protecting systems and their resources

  System owners, in consultation with each system’s authorising officer, select security controls for each system and tailor them to achieve desired security and resilience objectives.

• ISM-1635 · Protecting systems and their resources

  System owners implement security controls for each system and its operating environment.

• ISM-1636 · Protecting systems and their resources

  System owners, in consultation with each system’s authorising officer, ensure security controls for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system and its operating environment undergo a security control assessment by their organisation’s own assessors or Infosec Registered Assessor Program (IRAP) assessors to determine if they have been implemented correctly and are operating as intended.

• ISM-1918 · Reporting on cyber security

  The CISO regularly reports directly to their organisation’s audit, risk and compliance committee (or equivalent) on cyber security matters.

• ISM-1966 · Overseeing the cyber security program

  The CISO develops, implements, maintains and regularly verifies a register of systems used by their organisation.

• ISM-1967 · Protecting systems and their resources

  System owners, in consultation with each system’s authorising officer, ensure security controls for each TOP SECRET system and its operating environment, including each sensitive compartmented information system and its operating environment, undergo a security control assessment by ASD assessors (or their delegates) to determine if they have been implemented correctly and are operating as intended.

• ISM-1968 · Protecting systems and their resources

  System owners obtain an authorisation to operate for each TOP SECRET system, including for each sensitive compartmented information system, from Director-General ASD (or their delegate).

• ISM-1997 · Embedding cyber security

  The board of directors or executive committee defines clear roles and responsibilities for cyber security both within the board of directors or executive committee and broadly within their organisation.

• ISM-1998 · Embedding cyber security

  The board of directors or executive committee ensures that cyber security is integrated throughout all business functions within their organisation.

• ISM-1999 · Embedding cyber security

  The board of directors or executive committee ensures the cyber security strategy for their organisation is aligned with the overarching strategic direction and business strategy for their organisation.

• ISM-2000 · Embedding cyber security

  The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of their organisation, as well as the threat environment in which they operate, from internal and external subject matter experts.

• ISM-2001 · Championing a positive cyber security culture

  The board of directors or executive committee champions a positive cyber security culture within their organisation, including through leading by example.

• ISM-2002 · Building cyber security expertise

  The board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both their fiduciary duties and any legislative or regulatory obligations.

• ISM-2003 · Building cyber security expertise

  The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps within their organisation.

• ISM-2004 · Building cyber security expertise

  The board of directors or executive committee supports the development of cyber security skills and experience for all personnel via internal and external cyber security awareness raising and training opportunities.

• ISM-2005 · Identifying critical business assets

  The board of directors or executive committee understands the business criticality of their organisation’s systems, including at least a basic understanding of what systems exist, their value, where they reside, who has access, who might seek access, how they are protected, and how that protection is verified.

• ISM-2006 · Planning for major cyber security incidents

  The board of directors or executive committee plans for major cyber security incidents, including by participating in exercises, and understands their duties in relation to such cyber security incidents.

• ISM-2020 · Overseeing cyber security personnel

  The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cyber security activities within their organisation.

• ISM-2021 · Protecting systems and their resources

  System owners implement and maintain data minimisation practices for each of their systems.