ASD ISM 0726 Coordinate security risk management activities
What it says
The CISO coordinates security risk management activities between cyber security and business teams.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO ensures business and security teams work together effectively on managing security risks.
This control ensures that the Chief Information Security Officer (CISO) makes sure everyone in the organisation understands the potential risks to their digital systems. It's like having a designated person who gets everyone to work together on spotting any security threats and figuring out how to deal with them. If these teams don't communicate well, things can slip through the cracks, increasing the chance of data leaks or cyber attacks.
Free. Save your status, tasks and notes.
Why it matters
Without CISO-led coordination between cyber security and business teams, risk decisions can be inconsistent, leaving gaps in treatment and slower incident response.
How to implement
The CISO should organise regular meetings: Schedule meetings between security and business teams to discuss potential risks and security strategies.
These should happen monthly and include a clear agenda to cover what each team needs. This helps everyone stay on the same page.
Security officers should create a risk assessment checklist: Develop a checklist that business teams can use to identify potential security risks in their areas.
This checklist should be simple and encourage team members to spot potential issues before they become problems.
Business managers should complete a risk awareness training: Have managers participate in training sessions that explain common cyber threats and how they affect business operations.
This will equip managers with the knowledge they need to understand the importance of security measures.
The IT team should use clear communication tools: Implement easy-to-use tools and platforms where security and business teams can efficiently share updates and alerts.
For example, a shared online document or a chat group dedicated to security issues can help catch problems early.
HR should onboard new employees on security protocols: Include security awareness in the induction process for new staff, clearly explaining the organisation's approach to managing cyber risks.
Use easy-to-understand materials such as videos and infographics to make the information accessible.
Keep it running
Have the CISO run recurring cyber/business risk forums, maintain a shared risk register, and agree escalation paths so priorities and treatments stay aligned across teams.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Meeting minutes: Request the documented notes from meetings between security and business teams.
Look at
How frequently these meetings occur and the attendance list.
Good evidence
Shows regular meetings with active participation from all relevant parties.
- Check 2 of 5What an auditor asks for
Look at
Items that address specific risks relevant to each area.
Good evidence
Has a comprehensive checklist tailored to the organisation's risks.
- Check 3 of 5What an auditor asks for
Ask for
Training completion records: Request certificates or logs showing that managers have completed risk awareness training.
Look at
The completion dates and renewal requirements.
Good evidence
Shows up-to-date training for all key personnel.
- Check 4 of 5What an auditor asks for
Ask for
An overview or demonstration of the communication tools used by teams to share security information.
Look at
How these tools facilitate easy and fast communication.
Good evidence
Offers quick, clear pathways for sharing urgent security updates.
- Check 5 of 5What an auditor asks for
Ask for
Onboarding materials: Request the materials used in onboarding new employees about security protocols. Review these materials for clarity and relevance.
Good evidence
Shows that employees are informed about security right from the start.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining information security roles and responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-0726 overlaps by defining a specific CISO responsibility to coordinate security risk management between cyber security and business teams, which is an allocation of accountability for cross-functional risk activities. ISM-0726 is narrower and focused on coordination of risk management, while Annex A 5.2 is broader and covers defining and allocating all information security roles.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.