Skip to content
Cyber security roles
ASD ISMISM-0718

ASD ISM 0718 CISO reporting to board on cyber security

What it says

The CISO regularly reports directly to their organisation's board of directors or executive committee on cyber security matters.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

The CISO must regularly update the board or executive committee on cyber security issues.

The Chief Information Security Officer (CISO) should regularly update the board or executive committee about cyber security issues and strategies. This is important because if the organisation's leadership isn't aware of cyber risks, they can't make informed decisions to protect the company from financial loss or reputational harm due to security breaches.

Why it matters

Without direct CISO reporting to the board, cyber risk may be under‑reported, delaying investment decisions and worsening breach impact and governance outcomes.

How to implement

  1. The CISO should schedule regular meetings with the board: Set up a recurring appointment, perhaps monthly or quarterly, to ensure consistent communication.

    Present recent cyber security developments, potential risks, and how the team is addressing them.

  2. The IT team should prepare concise reports: Create straightforward summaries that highlight key security metrics and incidents.

    These reports should include clear explanations of technical terms to help the board understand the issues better.

  3. The HR department can help with training: Coordinate with the CISO to organise awareness sessions for board members.

    These sessions should equip them with the basic knowledge of cyber security risks and the organisation's strategies to mitigate them.

  4. Finance staff should collaborate with the CISO: Work together to estimate the financial impact of potential cyber security incidents.

    This information will help the board grasp the cost-benefit analysis of investing in cyber security measures.

  5. The CISO should use visual aids in presentations: Prepare slides with charts and graphics to illustrate complex information simply.

    Visuals can make it easier for board members to understand the state of cyber security and the effectiveness of current measures.

Keep it running

Schedule regular CISO briefings to the board/executive committee covering top risks, incidents, metrics, and funded remediation decisions aligned to risk appetite.

Evidence and audit

  1. Check 1 of 3What an auditor asks for

    Ask for

    Minutes from board meetings: Check if cyber security issues were discussed and who attended. Good minutes show consistent discussion of security matters with clear actions decided.

    Look at

    How clearly issues and strategies are presented.

    Good evidence

    Report should be easy to understand and show recent incidents and future plans.

  2. Check 2 of 3What an auditor asks for

    Ask for

    Training records: Verify if board members attended cyber security training. Good records list participants, topics covered, and the date of the session.

    Look at

    The estimated impacts of potential security breaches.

    Good evidence

    Assessment includes a cost-benefit analysis and recommendations for resource allocation.

  3. Check 3 of 3What an auditor asks for

    Ask for

    Presentation materials: Review if visuals used by the CISO aid in board understanding. Good materials should simplify complex security concepts and focus on critical data.

Mappings

Closest match in ISO/IEC 27001: A.5.36, Review compliance with information security policies, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.36Review compliance with information security policiesPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.