ASD ISM 0734 CISO role in disaster recovery planning
What it says
The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO helps to ensure recovery plans are in place to maintain essential services during a disaster.
The Chief Information Security Officer (CISO) plays a crucial role in creating and maintaining plans to keep your essential business services running if a disaster strikes, like a cyberattack or a natural event. If these plans aren't in place, an unexpected incident could stop the entire operation, leading to financial loss, data breaches, and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
If the CISO does not contribute to BCP/DR planning, recovery priorities may miss business-critical services, extending outages and increasing financial and reputational harm.
How to implement
CISOs should collaborate with business leaders to identify all critical services that need protection in case disaster strikes.
This involves listing services that, if interrupted, would have severe business and financial impacts, and prioritising them for recovery efforts.
The IT team should draft a disaster recovery plan that details how to restore each critical service identified.
They can achieve this by mapping out each required step from backup restoration to verifying functionality, ensuring all details are clearly documented and accessible.
Managers should organise regular practice runs of the disaster recovery plan to ensure everyone who needs to be involved knows their role.
This means setting up mock disaster events and running through the recovery steps to find any weaknesses in the plan.
System owners must ensure that any technology required for recovery is regularly tested and updated.
This includes checking that backups are current and that any software used in recovery can operate on newer systems.
HR should develop a communication plan to keep all employees informed during a disaster.
This includes setting up a phone tree or mass notification system to quickly and clearly communicate instructions or updates during an event.
Keep it running
Have the CISO review and sign off BCP/DR plans, ensure critical services and recovery objectives are defined, and run scheduled exercises to keep plans current.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The disaster recovery plan document: Ensure it includes clear steps for restoring essential services and names responsible team members.
Look at
Specific recovery procedures for different scenarios.
Good evidence
Will include a comprehensive, step-by-step plan with stakeholder roles defined.
- Check 2 of 5What an auditor asks for
Look at
The criteria used to determine criticality.
Good evidence
Includes a dated assessment with clear priorities and justifications.
- Check 3 of 5What an auditor asks for
Ask for
Training records related to disaster recovery: Check that regular drills or training sessions are held and documented.
Look at
Evidence of participation from key personnel.
Good evidence
Record shows that practice runs or refreshers happen at least annually with noted attendance and feedback.
- Check 4 of 5What an auditor asks for
Look at
The results of these tests to ensure they meet recovery objectives.
Good evidence
Includes a testing schedule and successful test outcomes.
- Check 5 of 5What an auditor asks for
Look at
Clear lines of communication and designated communication channels.
Good evidence
Has a readily accessible plan with a structured hierarchy and templates for messages.
Mappings
Closest match in ISO/IEC 27001: A.5.29, Maintain information security during disruptions, which this control partially meets.
ISO/IEC 27001: 4 mappings
This control partially meets A.5.29.
ISM-0734 requires the CISO to contribute to developing, implementing and maintaining business continuity and disaster recovery plans so business-critical services are supported during a disaster. ISO/IEC 27001:2022 Annex A 5.29 requires the organisation to plan how to maintain information security at an appropriate level during disruptions, which is a core objective within BC/DR planning. Annex A 5.29 is broader in scope (organisation-wide and focused on maintaining security during disruption), while ISM-0734 is role-specific (CISO contribution) and explicitly includes disaster recovery planning for critical services.
This control partially meets A.5.30.
ISM-0734 demands the CISO to assist in business continuity and disaster recovery planning to ensure business-critical services can be sustained in a disaster. ISO/IEC 27001:2022 Annex A 5.30 mandates planning, implementing, maintaining, and testing ICT readiness against continuity objectives, which is vital to effective DR planning. Annex A 5.30 is broader and more focused on ICT testing, while ISM-0734 emphasises the CISO's regulatory and oversight role across BC/DR planning.
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-0734 overlaps by defining a specific responsibility for the CISO to contribute to business continuity and disaster recovery planning. ISM-0734 is a role-specific duty in one domain (BC/DR), while Annex A 5.2 is broader and covers defining and allocating all information security responsibilities across the organisation.
This control partially overlaps A.7.5.
Annex A 7.5 requires organisations to design and implement protection against physical and environmental threats, including natural disasters affecting infrastructure. ISM-0734 relates by requiring the CISO to contribute to business continuity and disaster recovery planning to ensure critical services can be supported during disasters. The overlap is in disaster-related risk treatment, but ISM-0734 focuses on governance and recovery planning, while Annex A 7.5 focuses on preventative/protective physical and environmental safeguards.
ASD Essential Eight: 1 mapping
This control supports E8-RB-ML1.1.
ISM-0734 involves the CISO contributing to BC/DR plans so critical services are supported during disasters. ASD Essential Eight E8-RB-ML1.1 involves conducting and maintaining backups according to business criticality and continuity needs, a vital element for DR plan execution. E8-RB-ML1.1 is a specific operational control, complementing ISM-0734's governance requirement for fostering an effective BC/DR framework.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.