ASD ISM 0047 Approval process for cyber security documentation
What it says
Organisational-level cyber security documentation is approved by the chief information security officer while system-specific cyber security documentation is approved by the system's authorising officer.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCyber security documents need approval from the chief security officer or system officer based on their scope.
This control ensures that important cyber security documents are officially approved by the right people in the organisation. It's vital because if the necessary checks aren't done, important systems could be vulnerable or not compliant with standards, potentially leading to data breaches or other security incidents.
Free. Save your status, tasks and notes.
Why it matters
If cyber security documentation is not approved by the CISO or the system authorising officer, controls may be unendorsed, non-compliant and lead to avoidable security incidents.
How to implement
The chief information security officer (CISO) should coordinate with department managers to identify all organisational-level cyber security documents that need approval.
This can be done by listing current documents and responsibilities in a shared folder.
System owners should meet with the system's authorising officer to review system-specific security documentation.
They should ensure that the documents cover necessary security measures for the system and align with organisational policies.
The IT team should create a checklist for the authorising officer that highlights key security areas the system documentation must cover.
This checklist should be reviewed and updated annually to ensure it remains relevant.
Managers should organise training sessions for staff involved in creating or approving security documentation to ensure they understand approval procedures and responsibilities.
This training can be done via a workshop or an online course.
Designate a documentation coordinator to keep track of when documents need review and approval.
They can use calendar reminders and shared spreadsheets to manage timelines and ensure no documents are missed.
Keep it running
Record CISO approval for organisational documents and AO approval for system documents; keep signed evidence, and periodically review approval status after major changes.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The master list of organisational-level security documents.
Look at
Which documents require CISO approval and which have received it. Good evidence is a marked-up list showing dates of approval and the name of the approving officer.
- Check 2 of 4What an auditor asks for
Look at
The authorising officer's approval signature or email confirmation.
Good evidence
Is a document that clearly shows which aspects of the system it covers and the specifics of any recent approval.
- Check 3 of 4What an auditor asks for
Ask for
How they decide if a document needs their approval and how they ensure accuracy.
Good evidence
Is both parties describing their roles and the regular processes in place.
- Check 4 of 4What an auditor asks for
Look at
Evidence of training sessions conducted for staff on documentation approval processes.
Good evidence
Includes dates, attendee lists, and training materials or slides.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.1.
ISM-0047 requires organisational cyber security documentation to be approved by the CISO and system-specific documentation to be approved by the system's authorising officer. This relates directly to Annex A 5.1, which requires information security and topic-specific policies to be defined and approved by management. ISM-0047 is more prescriptive about who must approve and differentiates approval paths by documentation scope, whereas Annex A 5.1 is broader and covers publication, communication, acknowledgement, and review.
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-0047 overlaps by allocating specific approval responsibilities for cyber security documentation to the CISO and Authorising Officer, which are explicit security governance roles. ISM-0047 is narrower (documentation approval authority), whereas Annex A 5.2 covers role definition and allocation more generally, beyond document approvals.
This control partially overlaps A.5.3.
Annex A 5.3 requires segregation of conflicting responsibilities to reduce the risk of unauthorised or inappropriate actions going unchecked. ISM-0047 relates by separating approval authority for organisational cyber security documentation (CISO) from system-specific documentation (authorising officer), which is a governance form of segregation of duties. ISM-0047 is limited to documentation approval pathways, while Annex A 5.3 applies to any conflicting duties across operations, development, access administration and assurance.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.