ASD ISM 0039 Develop and maintain a cyber security strategy
What it says
A cyber security strategy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure there is a continuous and effective plan for safeguarding cyber activities and data.
Having a cyber security strategy means having a plan for keeping your digital stuff safe from cyber threats. This matters because without a plan, your important data could be vulnerable to hackers who might steal information, disrupt your business, or cause you financial harm.
Free. Save your status, tasks and notes.
Why it matters
Without a cyber security strategy, security activity becomes ad hoc, funding is misdirected, and risk decisions are inconsistent, increasing breach likelihood.
How to implement
Business owner or manager should draft the strategy: Develop a clear document outlining what digital assets you have and the steps your business will take to protect them.
Include who is responsible for managing the strategy and set clear timelines for reviewing it.
IT team should identify risks: Conduct a simple assessment of your cyber security risks by listing potential threats and how they might impact your business.
This helps tailor the strategy to address specific areas of concern.
Managers should engage staff: Organise training sessions to ensure all employees understand their role in the strategy and how to recognise and report suspicious activity.
Encourage a culture of security awareness across the organisation.
HR and procurement combine efforts: Include security checks when hiring new staff or buying new software or equipment.
Make sure new joiners or systems align with the security standards outlined in your strategy.
The board should review regularly: Set regular meetings to review the strategy's effectiveness and update it based on any new risks or changes in technology.
Ensure decisions and changes are documented thoroughly.
Keep it running
Review the cyber security strategy at least annually and after major change; align to business goals, risk appetite and governance, and track delivery of planned initiatives.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The written cyber security strategy document.
Look at
How it outlines roles, responsibilities, risks, and protective measures clearly.
Good evidence
Strategy is comprehensive, up-to-date, and aligned with current technology and threats.
- Check 2 of 4What an auditor asks for
Good evidence
Includes frequent meetings and documented outcomes and action items.
- Check 3 of 4What an auditor asks for
Ask for
How these are conducted and integrated into the strategy.
Good evidence
Would be a risk assessment that directly informs the strategy and shows ongoing updates.
- Check 4 of 4What an auditor asks for
Look at
Reports on past security incidents and how they were handled to see if they align with the strategy.
Good evidence
Should show procedures were followed as per the strategy.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.1.
ISM-0039 requires a cyber security strategy to be developed, implemented and maintained as an overarching plan for cyber security. Annex A 5.1 supports ISM-0039 by requiring information security and topic-specific policies to be defined, approved, communicated, acknowledged, and reviewed-key instruments through which a strategy is executed and governed. The ISO control is policy lifecycle focused, while ISM-0039 is broader and can include non-policy elements such as investment roadmaps, capability targets, and program metrics.
This control partially overlaps A.5.21.
ISM-0039 requires a maintained cyber security strategy that drives how the organisation manages cyber risks to its information and services. Annex A 5.21 overlaps by requiring defined processes to manage ICT supply chain security risks, which is a common strategic risk theme and should be covered within the cyber strategy. ISM-0039 is broader and not limited to supply chain risk, while Annex A 5.21 is deeper and more specific to supplier/product/service lifecycle controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.