ASD ISM 0888 Annual review of cyber security documentation
What it says
Cyber security documentation is reviewed at least annually and includes a 'current as at \[date\]' or equivalent statement.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCyber security documentation is reviewed at least annually and includes a 'current as at \[date\]' or equivalent statement.
This control is all about making sure your business's cyber security documents are kept up-to-date. It's like checking your pantry every year to toss expired items and restock essentials. If you don't do this, you might accidentally be following outdated advice, which could leave your organisation vulnerable to cyber threats.
Free. Save your status, tasks and notes.
Why it matters
If cyber security documentation is not reviewed at least annually, staff may follow outdated guidance, raising security risk and audit non-compliance.
How to implement
The IT manager should organise an annual review of all cyber security documents.
Start by setting a date, then gather all existing documents and ensure the right experts review them. They should check if each document is still relevant and up-to-date.
HR and the IT department should collaborate to update the 'current as at' date on all cyber security documents.
Identify each document's last review date and adjust any policies or instructions that have changed since then.
The office manager should ensure that any changes made to documents during the review process are communicated to all staff.
This can be done with a simple email or a quick office meeting, highlighting the key changes.
The business owner should appoint someone to be responsible for overseeing the annual review process.
This person will ensure that reviews are completed on time and that documents are properly stored for future reference.
The school principal should hold a debriefing session after the review to discuss lessons learned and improvements needed.
This can help make the next review process smoother and ensure everyone is on the same page.
Keep it running
Set an annual review cadence for all cyber security documents and add a "current as at [date]" line on each; track ownership and evidence of review.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The review schedule: Request the calendar or timeline that shows when cyber security documentation reviews are planned. Look to see if reviews are scheduled at least once a year.
Good evidence
Would include clear, recurring dates for annual reviews.
- Check 2 of 5What an auditor asks for
Ask for
A sample of updated documents: Request a few updated cyber security documents.
Look at
The 'current as at' date to ensure it reflects the latest review.
Good evidence
Includes documents with recent dates and evidence of updates.
- Check 3 of 5What an auditor asks for
Ask for
Meeting notes from the review: Request the notes or minutes from the document review meeting.
Look at
The names of participants, date of the meeting, and any changes agreed upon.
Good evidence
Includes comprehensive notes with clearly documented outcomes.
- Check 4 of 5What an auditor asks for
Ask for
The communication log: Request evidence showing how updates were communicated to staff.
Look at
Emails or meeting notes that detail the dissemination of the reviewed content.
Good evidence
Includes multiple forms of communication, like emails and meeting transcripts.
- Check 5 of 5What an auditor asks for
Ask for
To see the updated document storage: Request to see where the reviewed documents are stored. Look to ensure there is a clear and accessible filing system.
Good evidence
Includes a well-organised digital or physical filing system with clear labels.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.5.1.
ISM-0888 requires cyber security documentation to be reviewed at least annually and to include a clear 'current as at [date]' statement. ISO/IEC 27001:2022 Annex A 5.1 requires information security policies to be reviewed at planned intervals and when significant changes occur, which covers the review expectation for policy documents that would be part of cyber security documentation. Annex A 5.1 is broader (applies to the policy framework and change-driven reviews), while ISM-0888 is more prescriptive about annual cadence and explicit currency dating.
This control partially overlaps A.5.37.
Annex A 5.37 requires operating procedures for information processing facilities to be documented and made available to personnel who need them. ISM-0888 strengthens this by requiring cyber security documentation to be reviewed at least annually and dated, helping ensure the documented procedures referenced by Annex A 5.37 remain current and reliable for users. ISM-0888 does not itself require that operating procedures exist or are made available; it focuses on review cadence and currency markings.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.