ASD ISM 0717 CISO oversight of cyber security personnel
What it says
The CISO oversees the management of cyber security personnel within their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO is in charge of managing the organisation's cyber security staff.
The Chief Information Security Officer (CISO) is responsible for overseeing the cyber security team at their organisation. This ensures that the team is well-trained and prepared to handle threats, reducing the risk of data breaches that could harm the organisation's reputation and financial standing.
Free. Save your status, tasks and notes.
Why it matters
Without CISO oversight, cyber security personnel may be mismanaged, reducing accountability and resourcing and increasing likelihood of missed threats and major incidents.
How to implement
The CISO should conduct regular one-on-one meetings with each member of the cyber security team to discuss current projects, challenges, and professional development.
These meetings can be held monthly and documented to track progress and provide support where needed.
Human Resources should assist the CISO in developing clear job descriptions and responsibilities for all cyber security roles.
This can be achieved by conducting a review of existing roles and aligning them with security objectives, ensuring clarity in duties and expectations.
The IT manager should set up a skills inventory for the cyber security team.
This will help in identifying any training needs and ensuring team members have the skills needed for emerging threats. Regularly review this inventory and plan training sessions or courses to fill any gaps.
The cyber security team, led by the CISO, should establish a weekly check-in within the team to go over the latest threats and determine how those affect the organisation's systems.
This will help the team stay updated and adapt strategies accordingly.
Leadership (CISO, HR, and senior managers) should organise annual team-building exercises aimed at better communication and coordination within the cyber security team.
These activities can be simple workshops or seminars designed to improve teamwork and problem-solving skills.
Keep it running
Define the CISO's accountability for cyber security personnel: set roles, reporting lines and KPIs; review workload, resourcing and training regularly; and address capability gaps promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Documentation of the cyber security team meetings: Request records of the one-on-one and team meetings.
Look at
The meeting frequency, summaries of discussion topics, and follow-up actions.
Good evidence
Regularly documented meetings with follow-up actions and reviews noted.
- Check 2 of 5What an auditor asks for
Ask for
The cyber security roles and responsibilities document: Request the document that outlines each team member's role and their key responsibilities.
Look at
Alignment with the organisation's security objectives.
Good evidence
Detailed role descriptions that match current organisational needs.
- Check 3 of 5What an auditor asks for
Ask for
The skills inventory report: Request the latest skills inventory for the cyber security team.
Look at
The identified training needs and completed courses.
Good evidence
A comprehensive list of current skills, needs, and completed training, showing proactive skill development.
- Check 4 of 5What an auditor asks for
Ask for
Records of weekly threat check-ins: Request documentation or minutes of these meetings.
Look at
Updates on threat discussions and any changes in security strategies.
Good evidence
Consistent records showing recent threat analyses and adaptations in security protocols.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of team-building activities: Request details of past team-building initiatives and attendance records.
Look at
The types of activities conducted and their focus on teamwork and collaboration.
Good evidence
Documented activities with full participation aimed at improving team cohesion.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining information security roles and responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-0717 overlaps by defining the CISO's responsibility to oversee management of cyber security personnel, which is part of allocating and governing security responsibilities through staffing and management structures. ISM-0717 is narrower and focused on personnel oversight, while Annex A 5.2 is broader and applies to the definition and allocation of all security roles and duties.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.3.2.
Annex A 3.2 requires AI roles and responsibilities to be defined broadly, while ISM-0717 mandates the CISO to oversee cybersecurity personnel, potentially including those focused on AI security. The overlap is in governance for AI when cybersecurity is involved, but Annex A 3.2 encompasses more than security roles.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-04.1Assign sufficient skilled personnel to run security controls and define role responsibilitiesPartially overlaps
This control partially overlaps IT.GOV-04.1.
IT.GOV-04.1 requires sufficient skilled cyber security personnel and resources to operate and maintain security controls, with responsibilities defined in role descriptions; ISM-0717 supports the staffing side, with the CISO overseeing the management of cyber security personnel.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.