ASD ISM 1602 Ensure cyber security docs are communicated
What it says
Cyber security documentation, including notification of subsequent changes, is communicated to all stakeholders.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMake sure all stakeholders are informed about cyber security documents and their updates.
This control is about making sure everyone involved in an organisation is updated about the security documents and any changes made to them. It's like ensuring the whole team knows the latest game plan-if not, mistakes can happen, leaving your business vulnerable to cyber threats like data breaches or fraud.
Free. Save your status, tasks and notes.
Why it matters
If security document updates aren't communicated, stakeholders may follow outdated guidance, causing inconsistent controls and higher breach risk.
How to implement
Managers should regularly schedule meetings to update all team members about new or changed security documents.
They can do this by setting a monthly meeting where updated documents are discussed and questions are answered in plain language.
The IT team should establish a centralised online location where all security documents and their updates are stored.
They might use a secure intranet or a cloud-based solution to ensure everyone has access to the latest versions easily.
HR should collaborate with the IT department to ensure new employees are briefed on security documentation during their orientation.
This can be done through an introductory training session that explains the importance and basics of cyber security practices.
A designated staff member should be responsible for notifying all stakeholders of any changes to security documents.
This could involve emailing the updates and summaries to ensure everyone stays informed and compliant.
The board or leadership team should review and approve any changes to critical security documents.
This can be done in quarterly meetings where the implications of changes are discussed, and consensus is reached to maintain oversight.
Keep it running
Notify all stakeholders when cyber security documents change. Use change alerts and include updates in weekly security briefings; track acknowledgements.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The schedule of meetings related to security document updates.
Look at
The frequency and participant list of these meetings.
Good evidence
Shows regular gatherings where various departments are represented.
- Check 2 of 3What an auditor asks for
Ask for
Documentation of the employee onboarding process regarding security training. Examine if it includes up-to-date information on security practices. A well-documented process shows consistent and ongoing updates to training materials.
- Check 3 of 3What an auditor asks for
Ask for
A copy of the email or memo notifications sent to stakeholders about document updates. Review if these notifications occur promptly and include summaries of changes. Good communication should be clear, detailed, and prompt.
Look at
Evidence of active discussion, approval of changes, and clear action plans from these meetings. Effective oversight ensures important changes are validated and understood at the highest level.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which partially overlaps with this control.
ISO/IEC 27001: 4 mappings
This control partially overlaps A.5.1.
ISM-1602 requires cyber security documentation (and subsequent changes) to be communicated to all stakeholders. ISO/IEC 27001:2022 Annex A 5.1 similarly requires information security policies to be published/communicated (and reviewed when significant changes occur), aligning strongly with communicating policy documents and updates. However, ISM-1602 is broader in that it applies to cyber security documentation generally (not just policies) and explicitly emphasises notification of changes to all stakeholders.
This control partially overlaps A.5.4.
Annex A 5.4 requires management to ensure all personnel apply information security consistent with the organisation's policies and procedures. ISM-1602 requires that cyber security documentation (including changes) is communicated to all stakeholders, which directly contributes to personnel knowing what they must follow. ISM-1602 focuses on the communication/dissemination mechanism, whereas Annex A 5.4 focuses on management requiring and enforcing compliance once policies are established and communicated.
This control partially overlaps A.5.37.
ISM-1602 requires cyber security documentation, including change notifications, to be communicated to stakeholders. ISO/IEC 27001:2022 Annex A 5.37 requires documented operating procedures to be made available to personnel who need them, which overlaps with ensuring operational security documentation is distributed and accessible. Annex A 5.37 is narrower (availability to those who need procedures) and does not explicitly require proactive communication of updates to all stakeholders as ISM-1602 does.
This control partially overlaps A.6.3.
ISM-1602 requires cyber security documentation and changes to be communicated to all stakeholders. ISO/IEC 27001:2022 Annex A 6.3 requires personnel and relevant interested parties to receive awareness/training and regular updates of policies and procedures relevant to their job function, which includes communicating key documentation changes. The difference is that Annex A 6.3 is training/awareness-focused and role-relevance based, while ISM-1602 is a direct documentation communication requirement to all stakeholders.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.