ASD ISM 1525 Register systems with authorising officers
What it says
System owners register each system with its authorising officer.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystem owners must register their systems with the designated authorising officer for oversight.
System owners must inform a designated authorising officer about each system they manage. This is important because it ensures the right person is aware and can provide oversight, reducing the risk of systems being mismanaged or neglected, which can lead to security breaches or operational failures.
Free. Save your status, tasks and notes.
Why it matters
If systems aren't registered with an authorising officer, they may operate without formal authorisation, oversight or accountability, increasing unmanaged security risk.
How to implement
System owners should identify the authorising officer for their system.
To do this, consult the organisational chart or ask your direct supervisor to confirm who is responsible for the oversight of your systems.
System owners must compile a comprehensive overview of their systems.
This includes documenting the purpose, main functions, and any sensitive data it handles. A simple document or spreadsheet with these details can help keep everything organised.
Authorising officers should set regular check-ins with system owners.
This helps stay updated on any changes or concerns. These meetings can be scheduled monthly or quarterly, depending on the system's complexity or sensitivity.
System owners should create and maintain an easy-to-follow registration form for new systems.
This form should capture details such as system name, purpose, primary users, and technical environments. Having a standardised form makes it easier to consistently register systems.
IT teams should support system owners by providing templates or guidelines for system registration.
This ensures that all necessary details are captured and that the appropriate information is shared with authorising officers, removing ambiguity or errors.
Keep it running
Maintain a central system register and notify the authorising officer on onboarding, major changes, ownership transfer and decommissioning to keep authorisation current.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The system registration list: Request the document or system database where all active systems are listed along with their authorising officers.
Look at
The completeness of the list and whether each system has an officer assigned.
Good evidence
Shows a complete list with clear officer assignment for every system.
- Check 2 of 5What an auditor asks for
Ask for
The meeting schedule with authorising officers: Request the calendar or record of meetings between system owners and their authorising officers.
Look at
Whether meetings are held regularly as planned.
Good evidence
Is documentation showing regular meetings with notes on discussions.
- Check 3 of 5What an auditor asks for
Ask for
To see the registration forms: Request the completed registration forms for all systems.
Look at
Clarity and detail in each registration.
Good evidence
Is clear, detailed forms for each system, signed by the authorising officer.
- Check 4 of 5What an auditor asks for
Ask for
Communication records between system owners and authorising officers: Request emails or meeting records.
Look at
Evidence of ongoing communication.
Good evidence
Includes regular updates and feedback from the officers to the system owners.
- Check 5 of 5What an auditor asks for
Ask for
To see the initial system registration process document: Request the guidelines or templates used for registering systems.
Look at
Standardisation and clarity in instructions.
Good evidence
Shows a well-documented process that guides system owners on registering new systems.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining information security roles and responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-1525 overlaps by requiring system owners to register systems with their Authorising Officer, which relies on clear assignment of the system owner and authorisation responsibilities. ISM-1525 is a specific governance workflow for systems, while Annex A 5.2 is broader and covers role definition and allocation across the entire information security program.
This control depends on A.5.9.
Annex A 5.9 mandates a maintained inventory of information and associated assets and their owners. ISM-1525 (Register Systems with Authorising Officers) supports this by establishing an organisational process that records systems with an authorising officer. ISM-1525 focuses on governance, but does not cover all asset types comprehensively as Annex A 5.9 does.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.