ASD ISM 0714 Appoint a CISO to lead cyber security across IT and OT
What it says
A CISO is appointed to provide cyber security leadership and guidance for their organisation (covering IT and OT).
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe organisation must appoint a Chief Information Security Officer (CISO) who provides cyber security leadership and guidance. This leadership role must cover both Information Technology (IT, the systems that handle data, email and business applications) and Operational Technology (OT, the systems that monitor or control physical equipment, such as machinery, building services or industrial processes). The CISO is the named senior person accountable for setting direction, coordinating effort and advising the organisation on protecting both of these environments.
A CISO, short for Chief Information Security Officer, is the senior person put in charge of an organisation's cyber security. This control says you must actually appoint someone to that role and give them responsibility for leading and advising on security. Importantly, their remit has to stretch across two different worlds. The first is IT (Information Technology), which is the everyday computing you would recognise: laptops, servers, email, databases and business software. The second is OT (Operational Technology), which is the technology that runs physical things, for example industrial control systems, manufacturing machinery, power and water equipment, or building systems like lifts and air conditioning. These OT systems were often built before cyber threats were common and can be easy to overlook. Without one clearly named leader covering both, security effort tends to be fragmented. Different teams make their own decisions, gaps appear between the IT and OT environments, and no single person is accountable for the overall picture. That makes the organisation an easier target for criminals who want to steal data or disrupt operations.
Free. Save your status, tasks and notes.
Why it matters
Without an appointed CISO covering IT and OT, security effort fragments, gaps appear between systems, and no one is accountable for the whole.
How to implement
Senior leadership or the board formally appoints a named individual to the CISO role, recording the appointment in writing so there is no doubt about who holds the position.
The person responsible for the appointment writes the CISO role description so it explicitly states accountability for cyber security across both the IT (Information Technology) and OT (Operational Technology) environments, not IT alone.
The CISO sets the cyber security direction and provides guidance to the organisation by issuing security priorities, advising leadership on risk, and being the go-to authority that other teams escalate security decisions to.
The organisation gives the CISO the authority and reporting line needed to lead, for example a direct line to executive leadership, so their guidance carries weight and is not overruled at lower levels.
Where the organisation runs OT systems such as industrial control systems, machinery or building services, the CISO actively engages the teams that operate them so OT security is led with the same attention as IT security.
Keep it running
Keep the CISO appointment current; reconfirm the named person and their IT and OT remit whenever the role changes hands or the organisation restructures.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Who is your appointed Chief Information Security Officer (CISO) and when were they appointed?
Look at
A written appointment record, contract or board minute naming the individual and the date.
Good evidence
A current, signed and dated document naming a specific person in the CISO role.
- Check 2 of 5What an auditor asks for
Ask for
What does the CISO's role description say they are accountable for?
Look at
A role description or charter that names cyber security leadership as a core duty.
Good evidence
A documented role that clearly assigns responsibility for leading and advising on the organisation's cyber security.
- Check 3 of 5What an auditor asks for
Ask for
Does the CISO's remit cover Operational Technology (OT) as well as IT?
Look at
Explicit wording in the role description or strategy referencing OT, industrial control systems or physical-equipment systems.
Good evidence
The CISO's scope is stated to cover both IT and OT, with evidence of involvement in OT security.
- Check 4 of 5What an auditor asks for
Ask for
How does the CISO provide leadership and guidance to the rest of the organisation?
Look at
Examples such as security strategy documents, advice to executives, or decisions the CISO has signed off.
Good evidence
Dated artefacts showing the CISO actively setting direction and being consulted on security matters.
- Check 5 of 5What an auditor asks for
Ask for
Who does the CISO report to and what authority do they hold?
Look at
An organisation chart or reporting line showing seniority and access to executive leadership.
Good evidence
A reporting line that gives the CISO genuine authority to lead security across the whole organisation.
Mappings
Closest match in ASD Essential Eight: E8-AC-ML2.9, Cyber security incidents are reported promptly to CISO, which this control covers in full and more.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-0714 overlaps by requiring appointment of a CISO to provide cyber security leadership and guidance, which is a key role allocation within the security governance model. ISM-0714 is narrower (mandating a specific role exists), while Annex A 5.2 is broader (defining and allocating all roles and responsibilities, whether centralised or delegated).
This control partially overlaps A.5.24.
Annex A 5.24 requires planning and preparation for incident management, including defining roles and responsibilities. ISM-0714 relates by requiring appointment of a CISO to provide cyber security leadership and guidance, which contributes to having accountable roles for incident management planning and coordination. ISM-0714 is broader organisational leadership/governance and not incident-management-specific, while Annex A 5.24 is specifically about incident management planning and preparation.
ASD Essential Eight: 2 mappings
This control is broader than E8-AC-ML2.9.
ISM-0714 requires the organisation to appoint a CISO to provide cyber security leadership and guidance. E8-AC-ML2.9 requires cyber security incidents to be reported promptly to the CISO (or delegate), which assumes the CISO role exists and is identifiable. ISM-0714 is therefore broader in establishing the leadership role that enables the reporting pathway specified by E8-AC-ML2.9.
This control partially meets E8-AH-ML2.16.
ISM-0714 requires appointing a CISO to lead and guide cyber security across IT and OT. E8-AH-ML2.16 mandates that incidents are reported immediately to the CISO (or delegate), which relies on the existence of that CISO function and its authority to receive escalations. ISM-0714 establishes the role and leadership accountability, while E8-AH-ML2.16 is a specific procedural requirement for incident reporting.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.