ASD ISM 0725 Cyber security steering committee coordination
What it says
The CISO coordinates cyber security and business alignment through a cyber security steering committee or advisory board, comprising key cyber security and business executives, which meets formally and regularly.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO aligns cyber security with business by regularly meeting with a dedicated committee of key executives.
This control ensures the Chief Information Security Officer (CISO) meets with a group of key business and security leaders regularly to align the organisation's security efforts with its business goals. Without this coordination, security measures might neglect critical business areas, leading to potential data breaches or operational disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without regular alignment, security strategies might miss business-critical areas, leading to data breaches or operational issues.
How to implement
The CISO should form a steering committee consisting of key executives from both the business and cyber security teams.
Invite these individuals to ensure that the group reflects a balance of security needs and business priorities.
Meeting organiser should schedule regular meetings, ideally monthly, where the agenda includes updates on security threats, status of current security measures, and alignment with business objectives.
Ensure each meeting has clear minutes and action items.
Each committee member should prepare reports on risk areas and challenges in their respective functions before meetings.
This involves identifying pressing security issues that could affect business operations.
The CISO should review the effectiveness of current policies and strategies with the committee.
Use this review process to flag new risks and reassess security priorities based on business changes.
Assign a dedicated note-taker to document meeting discussions and decisions.
Ensure these minutes cover key points such as agreed actions, responsibilities, and timelines for follow-ups.
Keep it running
Maintain an updated contact list for committee members and ensure everyone stays informed of upcoming meetings and actions required.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for past agendas of the cyber security steering committee or advisory board.
Look at
Check that the agendas address both cyber security and business objectives, and that meetings are held formally and regularly.
Good evidence
A good agenda clearly shows a balance between security strategies and business needs, with a regular meeting cadence evident across the agendas.
- Check 2 of 5What an auditor asks for
Ask for
Request meeting minutes for at least the last six months.
Look at
Verify that the minutes capture discussion points and decisions made by the committee.
Good evidence
Good minutes include assigned action items with owners and deadlines, and show the CISO coordinating the discussion.
- Check 3 of 5What an auditor asks for
Ask for
Ask to see the list of committee members.
Look at
Look for diversity in roles, including key cyber security and business executives.
Good evidence
A good list reflects a balance of executives from different areas of the organisation, with the CISO among the members.
- Check 4 of 5What an auditor asks for
Ask for
Request a log of security initiatives discussed by the committee.
Look at
Check that these initiatives align with business goals.
Good evidence
A good log lists clear initiatives and evidence of alignment with business strategy.
- Check 5 of 5What an auditor asks for
Ask for
Ask for approved reports on security status updates presented to the committee.
Look at
Examine these reports for accuracy and relevance to business strategies.
Good evidence
Good reports provide insightful analysis of how security measures affect business operations.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining information security roles and responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-0725 overlaps by defining a specific governance responsibility for the CISO (coordinating a cyber security steering committee) and implying participation responsibilities for executives on that committee. ISM-0725 is narrower and prescriptive about a coordination mechanism, while Annex A 5.2 is broader and not tied to a particular committee structure.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.