ASD ISM 0720 Develop and maintain a cyber security communication strategy
What it says
The CISO oversees the development, implementation and maintenance of a cyber security communications strategy to assist in communicating the cyber security vision and strategy for their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO creates and updates a strategy to share the organisation's cyber security goals effectively.
The Chief Information Security Officer (CISO) needs to set up a plan to communicate the organisation's cyber security goals clearly to everyone involved. This is important because if people don't understand the cyber security goals, they might not follow security measures, which can lead to data breaches or other cyber incidents.
Free. Save your status, tasks and notes.
Why it matters
Without a CISO-led cyber security communications strategy, staff and executives receive inconsistent guidance, delaying response and increasing incident likelihood.
How to implement
The CISO should organise a workshop with key staff members, such as managers and team leaders, to discuss the current cyber security goals and how they align with the organisation's overall objectives.
During this workshop, collaboratively identify communication methods that best reach all employees and stakeholders.
Managers should develop tailored messaging for their teams that explains how cyber security goals impact their specific roles.
They can do this by collaborating with the IT team to simplify technical information into everyday language, ensuring clarity and understanding.
The IT department should create clear and concise visual aids, such as posters or infographics, that summarise the organisation's main cyber security strategies.
Display these materials in common areas and distribute them electronically to keep cyber security at the forefront of employees' minds.
Human Resources should incorporate cyber security training into their onboarding process for new employees.
They can integrate this by developing a simple, engaging training module that highlights key cyber security messages and best practices within the organisation.
The CISO should establish a regular communication schedule to update the entire organisation on changes to the cyber security strategy.
This can be achieved through quarterly newsletters or all-hands meetings where successes and new challenges are discussed openly.
Keep it running
Maintain a CISO-approved comms plan with audiences, channels and cadence; include incident updates, awareness messages, ownership and measures of reach/effectiveness.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The documented cyber security communication strategy: Verify it is updated regularly and aligns with the organisation's goals.
Look at
The last updated date and how frequently updates are scheduled.
Good evidence
A well-documented plan reviewed at least annually with specific communication goals.
- Check 2 of 5What an auditor asks for
Ask for
Records of cyber security workshops or meetings: Check attendance lists and meeting minutes to ensure they are inclusive of key members.
Look at
Evidence of participation from diverse parts of the organisation. Good is when meetings are held consistently with participation from all departments.
- Check 3 of 5What an auditor asks for
Ask for
Samples of communication materials like newsletters or infographics: Examine the clarity and relevance of the information provided.
Look at
Concise language, clear graphics, and easy-to-understand information.
Good evidence
Regularly updated materials that clearly convey cyber security objectives.
- Check 4 of 5What an auditor asks for
Ask for
The onboarding training modules: Review the content for comprehensiveness and accessibility.
Look at
Whether it is available to all new hires and contains practical cyber security information. Good is an engaging, easy-to-follow module that is integrated into the onboarding process for every employee.
- Check 5 of 5What an auditor asks for
Ask for
Records of feedback mechanisms: Enquire about how feedback is collected regarding the effectiveness of communication strategies.
Look at
The methods used, such as surveys or suggestion boxes. Good is when feedback is systematically collected and used to improve the communication processes.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control supports.
ISO/IEC 27001: 1 mapping
This control supports A.6.3.
ISM-0720 requires the CISO to oversee a cyber security communications strategy that communicates the organisation's cyber security vision and strategy. That strategy provides a structured channel for the ongoing awareness and regular updates that Annex A 6.3 requires personnel and relevant interested parties to receive. Annex A 6.3 also requires education and role-based training, which a communications strategy alone does not deliver.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.