ISM Control Catalogue

The board of directors or executive committee defines clear roles and responsibilities for cyber security both within the board of directors or executive committee and broadly within their organisation.

The board of directors or executive committee ensures that cyber security is integrated throughout all business functions within their organisation.

The board of directors or executive committee ensures the cyber security strategy for their organisation is aligned with the overarching strategic direction and business strategy for their organisation.

The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of their organisation, as well as the threat environment in which they operate, from internal and external subject matter experts.

The board of directors or executive committee champions a positive cyber security culture within their organisation, including through leading by example.

The board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both their fiduciary duties and any legislative or regulatory obligations.

The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps within their organisation.

The board of directors or executive committee supports the development of cyber security skills and experience for all personnel via internal and external cyber security awareness raising and training opportunities.

The board of directors or executive committee understands the business criticality of their organisation's systems, including at least a basic understanding of what exists, their value, where they reside, who has access, who might seek access, how they are protected, and how that protection is verified.

The board of directors or executive committee plans for major cyber security incidents, including by participating in exercises, and understand their duties in relation to such cyber security incidents.

A CISO is appointed to provide cyber security leadership and guidance for their organisation (covering information technology and operational technology).

The CISO oversees their organisation's cyber security program and ensures their organisation's compliance with cyber security policy, standards, regulations and legislation.

The CISO regularly reviews and updates their organisation's cyber security program to ensure its relevance in addressing cyber threats and harnessing business and cyber security opportunities.

The CISO develops, implements, maintains and verifies on a regular basis a register of systems used by their organisation.

The CISO implements cyber security measurement metrics and key performance indicators for their organisation.

The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board, comprising of key cyber security and business executives, which meets formally and on a regular basis.

The CISO coordinates security risk management activities between cyber security and business teams.

The CISO regularly reports directly to their organisation's board of directors or executive committee on cyber security matters.

The CISO regularly reports directly to their organisation's audit, risk and compliance committee (or equivalent) on cyber security matters.

The CISO is fully aware of all cyber security incidents within their organisation.

The CISO oversees their organisation's response to cyber security incidents.

The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster.

The CISO oversees the development, implementation and maintenance of a cyber security communications strategy to assist in communicating the cyber security vision and strategy for their organisation.

The CISO oversees cyber supply chain risk management activities for their organisation.

The CISO receives and manages a dedicated cyber security budget for their organisation.

The CISO oversees the management of cyber security personnel within their organisation.

The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cyber security activities within their organisation.

The CISO oversees the development, implementation and maintenance of their organisation's cyber security awareness training program.

Each system has a designated system owner.

System owners register each system with its authorising officer.

System owners, in consultation with each system's authorising officer, determine the system boundary, business criticality, and security and resilience objectives for each system based on an assessment of the impact if it were to be compromised or attacked.

System owners, in consultation with each system's authorising officer, conduct a threat and risk assessment for each system.

System owners, in consultation with each system's authorising officer, select controls for each system and tailor them to achieve desired security and resilience objectives.

System owners, in consultation with each system's authorising officer, identify any supplementary controls required based upon the unique nature of each system, its operating environment and the organisation's risk tolerances.

System owners implement controls for each system and its operating environment.

System owners, in consultation with each system's authorising officer, ensure controls for each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system and its operating environment undergo a security assessment by their organisation's own assessors or IRAP assessors to determine if they have been implemented correctly and are operating as intended.

System owners continuously monitor the security of each system, and manage associated cyber threats, security risks and controls.

System owners implement and maintain data minimisation practices for each of their systems.

System owners report the security status of each system to its authorising officer at least annually.