ASD Essentials IT.GOV-01.1 Formalise Executive and Board Accountability for Cyber Security and Risk Appetite
What it says
Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDefines and regularly reviews formal executive and board accountability for cyber security, including setting, monitoring and adjusting how much risk to accept.
The board or executive team must formally own cyber security, with one named senior person answering for it. Leaders also decide how much risk to accept (the risk appetite). To meet this, write down who is accountable, what they report and how often. Track risk against the appetite and adjust the appetite as needed. Review this on a set schedule and after restructures or leadership changes. For example, the board charter names the accountable executive.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Governance and culture: a capability domain, which ASD applies across all phases from the start.
Why it matters
Without a clear owner at the top, cyber security decisions are made unevenly. Serious risks reach the board only after an incident. The organisation can also carry more risk than its leaders would knowingly accept.
How to implement
The board chair should write the cyber security duties into a governing document, such as the board charter or delegations (who may decide what).
Name the accountable executive or board member, and include setting, tracking and adjusting the risk appetite.
The governance lead, such as the company secretary, should put these duties to the board for formal adoption and record the decision in the minutes.
Add each duty to the named person's role description.
The accountable executive should write down what is reported to the board, by whom and how often.
Book each report in the governance calendar, and keep every board paper and its minutes.
The board or executive committee should approve the risk appetite, such as a short statement of how much cyber risk is acceptable.
Receive risk reports against it, and record each decision to confirm or adjust it.
The governance lead should set a review schedule for these duties.
Run an extra review after any restructure or leadership change, and record each outcome in the minutes.
Keep it running
The company secretary or board secretariat keeps the accountability documents, reporting calendar and review schedule up to date. The security and risk teams prepare regular reports on cyber risk against the risk appetite. Treat any restructure, or a change of executives or board members, as a trigger for a review. This action applies organisation-wide, in every priority phase, so set it up early.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the board charter, terms of reference or delegations that assign cyber security accountability.
Look at
Whether a named person holds written accountability, or ownership is informal or just assumed.
Good evidence
A named executive or board member holds written accountability, formally adopted by the board.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the written reporting duties and the governance calendar.
Look at
Whether they say what is reported, by whom and how often, or only name an owner.
Good evidence
The reporting duties are specific, and each report is booked in the calendar.
- Check 3 of 5What an auditor asks for
Ask for
Ask for recent cyber security board papers and minutes.
Look at
Whether reports exist and follow the schedule, or come only now and then, such as after an incident.
Good evidence
Reports reach the board on schedule, and the minutes show they were discussed.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the approved risk appetite and the decisions recorded against it.
Look at
Whether a risk appetite is set at all, and tracked and revisited, not approved once and left.
Good evidence
Cyber risk is reported against the risk appetite, which is confirmed or adjusted over time.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the review schedule and the records of recent reviews.
Look at
Whether reviews happened on time and after restructures, or documents still name people who have left.
Good evidence
Reviews happen on schedule and after leadership changes, and the documents are updated each time.
ASD indicators of good practice (12)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(4)
- NE-1No named executive or board member is accountable for cyber security.
- NE-2Cyber security accountability exists only informally, or is assumed rather than documented.
- NE-3No evidence of cyber security reporting to the executive board.
- NE-4Organisational risk appetite is not set.
Partially effective(4)
- PE-1A named executive or board member is accountable for cyber security, but reporting obligations are not formally defined.
- PE-2Board-level reporting on cyber security occurs but is ad hoc rather than on a defined schedule.
- PE-3Accountability is documented but has not been reviewed within the organisationally defined cadence or following relevant organisational restructuring or leadership changes.
- PE-4Organisational risk appetite is set but is not monitored or adjusted over time.
Fully effective(4)
- FE-1A named executive or board member has documented accountability for cyber security with defined reporting obligations.
- FE-2Regular reporting to the board or executives occurs on a defined cadence with evidence of reporting artefacts.
- FE-3Accountability arrangements are reviewed when organisational structures or leadership changes occur.
- FE-4Organisational risk appetite is set and is monitored and adjusted over time as required.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining Information Security Roles and Responsibilities, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.2.
IT.GOV-01.1 requires the organisation to formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting risk appetite, and to review them at a defined cadence. This is a specific, top-level case of ISO/IEC 27001 Annex A 5.2, which requires information security roles and responsibilities to be defined and allocated according to organisational needs. Annex A 5.2 covers security roles at every level, while IT.GOV-01.1 is limited to executive and board accountability but is more explicit about risk appetite ownership and periodic review.
ASD Information Security Manual: 5 mappings
This control partially overlaps ISM-1997.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security and risk appetite; ISM-1997 covers defining roles, requiring the board or executive committee to set clear cyber security roles and responsibilities for itself and the organisation.
This control partially overlaps ISM-1998.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security and risk appetite; ISM-1998 sets one such accountability, with the board or executive committee ensuring cyber security is integrated throughout all business functions.
This control partially overlaps ISM-1999.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security and risk appetite; ISM-1999 gives one concrete accountability, with the board or executive committee ensuring the cyber security strategy aligns with the organisation's business strategy.
This control partially overlaps ISM-2000.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security, including monitoring risk appetite; ISM-2000 supports that monitoring, with the board or executive committee seeking regular briefings on cyber security posture and the threat environment.
This control partially overlaps ISM-2005.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security and risk appetite; ISM-2005 supports this, requiring the board or executive committee to understand the business criticality of the organisation's systems and how they are protected.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.