What does ASD ISM 0718 require?

policyASD Information Security Manual (ISM)

ASD ISM 0718CISO Reporting to Board on Cyber Security

Official control statement

The CISO regularly reports directly to their organisation's board of directors or executive committee on cyber security matters.

policyASD Information Security Manual (ISM)ISM-0718

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

The CISO must regularly update the board or executive committee on cyber security issues.

NC OS PASD Information Security ManualGuidelines for cyber security roles

Control Stack classificationProactive Security governance and leadership Governance User behaviour

record_voice_over

What this means in practice

The Chief Information Security Officer (CISO) should regularly update the board or executive committee about cyber security issues and strategies. This is important because if the organisation's leadership isn't aware of cyber risks, they can't make informed decisions to protect the company from financial loss or reputational harm due to security breaches.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Proactive

Classifications

NC, OS, P, S, TS

ISM last updated

Dec 2025

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for cyber security roles

Section

Chief information security officer

Topic

Reporting on cyber security

priority_high

Why it matters

Without direct CISO reporting to the board, cyber risk may be under‑reported, delaying investment decisions and worsening breach impact and governance outcomes.

settings

Operational notes

Schedule regular CISO briefings to the board/executive committee covering top risks, incidents, metrics, and funded remediation decisions aligned to risk appetite.

02 - Implement

build

Implementation tips

The CISO should schedule regular meetings with the board: Set up a recurring appointment, perhaps monthly or quarterly, to ensure consistent communication. Present recent cyber security developments, potential risks, and how the team is addressing them.
The IT team should prepare concise reports: Create straightforward summaries that highlight key security metrics and incidents. These reports should include clear explanations of technical terms to help the board understand the issues better.
The HR department can help with training: Coordinate with the CISO to organise awareness sessions for board members. These sessions should equip them with the basic knowledge of cyber security risks and the organisation's strategies to mitigate them.
Finance staff should collaborate with the CISO: Work together to estimate the financial impact of potential cyber security incidents. This information will help the board grasp the cost-benefit analysis of investing in cyber security measures.
The CISO should use visual aids in presentations: Prepare slides with charts and graphics to illustrate complex information simply. Visuals can make it easier for board members to understand the state of cyber security and the effectiveness of current measures.

03 - Audit

fact_check

Audit / evidence tips

AskMinutes from board meetings: Check if cyber security issues were discussed and who attended. Good minutes show consistent discussion of security matters with clear actions decided
Look atHow clearly issues and strategies are presentedGoodReport should be easy to understand and show recent incidents and future plans
AskTraining records: Verify if board members attended cyber security training. Good records list participants, topics covered, and the date of the session
Look atThe estimated impacts of potential security breachesGoodAssessment includes a cost-benefit analysis and recommendations for resource allocation
AskPresentation materials: Review if visuals used by the CISO aid in board understanding. Good materials should simplify complex security concepts and focus on critical data