ASD ISM 1587 Annual security status reporting for systems
What it says
System owners report the security status of each system to its authorising officer at least annually.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSystem owners must annually report each system's security status to an authorising officer.
System owners have to check and report how secure their systems are at least once a year to the person in charge of approving them. This is important because it keeps everyone aware of any risks or weaknesses in the systems, so they can fix problems before they lead to data leaks or other issues that could damage the organisation's reputation or operations.
Free. Save your status, tasks and notes.
Why it matters
Missing annual security status reports can conceal system risks, leaving issues unreported to the authorising officer and increasing breach likelihood.
How to implement
System owners should schedule an annual review with the authorising officer to discuss the system's security.
They can do this by setting a fixed date each year and preparing a short report on recent security assessments and updates done on the system. This ensures that the officer is kept informed and can advise on necessary actions.
System owners should create a checklist of security measures currently in place for the system.
This checklist might include antivirus software status, firewall rules, and whether regular software updates are being applied. Reviewing and updating this checklist before meeting with the authorising officer helps provide a clear picture of the system's security.
The IT team should run a security assessment on each system before the annual review.
This could involve vulnerability scanning and checking access controls to find any weak points. The results should be compiled into a report to inform discussions during the formal review.
System owners should organise a follow-up session after the review meeting to outline any required improvements.
They can work with IT and staff concerned with system security to address any weaknesses identified during the initial review. Documenting these plans helps track progress and ensure accountability.
The business manager should ensure records of these reviews are maintained.
Using a simple filing system, they can store reports, checklists, and meeting notes in a central location. This makes it easy to retrieve documents for auditing or subsequent reviews.
Keep it running
Schedule annual security status reports and submit them to the authorising officer; include changes, incidents, outstanding risks and remediation progress.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The most recent system security status report: Request the report submitted to the authorising officer.
Look at
The report's details, such as the systems reviewed, findings, and recommendations.
Good evidence
Report will be dated within the last year and provide a thorough assessment that matches system characteristics.
- Check 2 of 4What an auditor asks for
Good evidence
Record will be signed by both parties and include agreed steps to improve system security.
- Check 3 of 4What an auditor asks for
Ask for
To see the security measure checklist: Verify the checklist contains current information on antivirus use, firewall settings, software updates, and other security practices.
Good evidence
Checklist is regularly updated, reflecting the last review findings.
- Check 4 of 4What an auditor asks for
Look at
Reports for any identified risks and the steps taken to mitigate them. Good reports will include clear descriptions of vulnerabilities found and actions taken to resolve them.
Mappings
Closest match in ISO/IEC 27001: A.5.35, Independent review of information security, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.35.
ISM-1587 requires system owners to report the security status of each system to the system's authorising officer at least annually. Annex A 5.35 requires an independent review of the organisation's information security approach and its implementation at planned intervals or on significant change, which can produce evidence and findings that feed into an annual system security status report under ISM-1587. The overlap is in assurance and periodic governance reporting, but Annex A 5.35 emphasises independence and organisation-wide review, while ISM-1587 focuses on system-level status reporting to the authorising officer.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.