ASD Essentials IT.GOV-03.1 Assess and Treat Cyber Security Risks Using an Approved Methodology and Plan
What it says
Establish and maintain an approved risk management methodology and plan that is used to assess and treat cyber security risks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMaintains an approved method and plan, and uses them to rate each cyber security risk, choose a response and carry it out.
The organisation writes down how it rates each cyber risk and chooses a response. A plan sets what is assessed, by whom and how often. To meet this, both are formally approved and followed. Risks are assessed on schedule and kept in a current risk register. Each is reduced, avoided, shared with another party or formally accepted, and agreed actions are done. For example, a second login check reduces the risk from stolen passwords.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Governance and culture: a capability domain, which ASD applies across all phases from the start.
Why it matters
Without an approved method that people follow, risks are rated unevenly, assessments lapse or miss systems, and fixes go unrecorded or stall. Known weaknesses stay open, and leaders carry risks they never saw or agreed to.
How to implement
The risk manager should write a cyber risk method based on the organisation's main risk framework.
Set rating scales, acceptable risk levels, treatment options and who may accept leftover risk, and have the board, executive committee or delegate approve it.
The security and risk leads should prepare a risk management plan naming the in-scope assets, their risk owners, who assesses and how results are reported.
Set the assessment cycle, and have the same authority approve it.
Risk owners should assess every in-scope asset on the planned cycle, using the approved method and scales.
Record each risk in the risk register, such as a shared spreadsheet or risk tool, with its owner, rating, decision and status.
The risk owner should record each treatment decision and its approver, then track a plan with owners and due dates to completion.
Have an authorised person accept any leftover risk in writing, such as on a signed risk acceptance form.
The risk manager should review the register, method and plan on set cycles, and seek re-approval whenever the method or plan changes.
Report overdue assessments and stalled fixes to the executive or board.
Keep it running
The risk manager keeps the register current, runs assessments and register reviews on the set cycle, and chases fixes to the end. Record each acceptance with its approver and date. This action applies organisation-wide, in every priority phase, so its assessments must cover every in-scope asset, from infrastructure and operating systems to applications and data. Use the same rating scales for every system so results can be compared.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the risk management method and its approval record.
Look at
Whether it is formally approved, or still a draft, a template or informal practice.
Good evidence
An approved, current method is in place, and it is the version staff actually use.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the approved risk management plan and two or three recent assessments under it.
Look at
Whether assessments follow the method's scales and the plan's scope, or use their own scoring.
Good evidence
Assessments apply the approved method and plan consistently and lead to recorded treatment decisions.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the risk register and the records of its recent reviews.
Look at
Whether the register is current and reviewed within the set cycle, or entries are out of date.
Good evidence
The register is current, and its history shows reviews within the set cycle.
- Check 4 of 5What an auditor asks for
Ask for
Ask for treatment decisions and plans for a sample of risks, including accepted ones.
Look at
Whether decisions name an approver, plans are complete, and actions are done or overdue.
Good evidence
Each sampled risk has a written decision and a completed plan, with leftover risk formally accepted.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the plan's list of in-scope assets and when each was last assessed.
Look at
Whether any in-scope assets were never assessed, or assessments are overdue.
Good evidence
Every in-scope asset has been assessed, and no assessment is overdue.
ASD indicators of good practice (9)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1No risk management methodology approved by the organisation is in place.
- NE-2No current organisational risk register exists, or the register has not been reviewed within the cycle defined by the organisation.
- NE-3Risk treatment decisions are not documented.
Partially effective(3)
- PE-1An approved risk management methodology exists but risk assessments have not been conducted within the defined cycle.
- PE-2A risk register exists but treatment plans are incomplete or have not been actioned.
- PE-3Risk assessments have been conducted but do not cover all in-scope assets.
Fully effective(3)
- FE-1An approved risk management methodology and plan are in place and used to assess and treat security risks.
- FE-2A current risk register exists with documented and implemented treatment plans for all identified risks.
- FE-3Risk assessments have been conducted or reviewed within the assessment cycle defined by the organisation.
Mappings
Closest match in ASD Information Security Manual: ISM-0009, System Owners Identify Supplementary Controls With Authorising Officer, which partially overlaps with this control.
ASD Information Security Manual: 4 mappings
This control partially overlaps ISM-0009.
IT.GOV-03.1 requires an approved risk management methodology and plan used to assess and treat cyber security risks; ISM-0009 is one treatment step, with system owners identifying supplementary controls for each system based on its nature, environment and organisational risk tolerances.
This control partially overlaps ISM-1203.
IT.GOV-03.1 requires an approved risk management methodology and plan used to assess and treat cyber security risks; ISM-1203 applies the assessment part, with system owners conducting a threat and risk assessment for each system in consultation with its authorising officer.
- ISM-1526System Owners Continuously Monitor Security and Manage Threats, Risks and ControlsPartially overlaps
This control partially overlaps ISM-1526.
IT.GOV-03.1 requires an approved risk management methodology and plan used to assess and treat cyber security risks; ISM-1526 supports ongoing treatment, with system owners continuously monitoring each system's security and managing its cyber threats, security risks and controls.
- ISM-1634System Owners Select and Tailor Controls in Consultation with Authorising OfficerPartially overlaps
This control partially overlaps ISM-1634.
IT.GOV-03.1 requires an approved risk management methodology and plan used to assess and treat cyber security risks; ISM-1634 covers treatment at system level, with system owners selecting and tailoring security controls to meet each system's security and resilience objectives.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.