ASD ISM 1617 Regular review of cyber security program
What it says
The CISO regularly reviews and updates their organisation's cyber security program to ensure its relevance in addressing cyber threats and harnessing business and cyber security opportunities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO ensures the cyber security program stays relevant to combat threats and seize opportunities.
The cyber security boss needs to frequently check and update the company's plan for dealing with online threats. This is important because if they fall behind, the company could become vulnerable to new types of cyber attacks, leading to potential data breaches or financial losses.
Free. Save your status, tasks and notes.
Why it matters
Without regular reviews and updates, the cyber security program can drift from current threats and business priorities, increasing likelihood of incidents and reputational harm.
How to implement
The CISO should schedule regular reviews of the cyber security plan.
This involves setting quarterly meetings with the IT team to discuss any changes in the threat landscape and making updates to the plan accordingly.
The IT team should monitor emerging cyber threats.
This can be done by subscribing to cyber security alerts from the Australian Cyber Security Centre (ACSC) and sharing relevant updates with the CISO during review meetings.
The training manager should update employee cyber security training programs.
Collaborate with the IT team to ensure that the training reflects the latest cyber security practices and threat information.
The CISO should involve senior management in cyber security discussions.
Organise briefing sessions to communicate the importance of the updated cyber security measures and to get their support.
The finance manager should ensure budget allocations for cyber security tools and resources are regularly reviewed.
Work with the CISO to prioritise spending on the most critical areas identified during reviews.
Keep it running
Run biannual CISO-led program reviews; update the security roadmap, priorities and metrics using recent incidents, threat intel and business changes, and track actions to closure.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The schedule of cyber security program reviews: Request the calendar of past and upcoming review meetings.
Look at
Whether the reviews are happening regularly as planned.
Good evidence
Is a detailed schedule with completed and planned reviews marked.
- Check 2 of 5What an auditor asks for
Ask for
Minutes from the review meetings: Review the written records of these meetings.
Look at
Who attended, what was discussed, and any actions or updates made to the cyber security plan.
Good evidence
Includes thorough documentation with specific updates noted.
- Check 3 of 5What an auditor asks for
Ask for
Recent threat intelligence reports: Request any reports or alerts received from the ACSC or other sources.
Look at
How this information was used to update the cyber security plan.
Good evidence
Shows the threats were acknowledged and the plan adjusted accordingly.
- Check 4 of 5What an auditor asks for
Ask for
Updated cyber security training materials: Request copies of the latest training documents for staff.
Look at
Whether they reflect current cyber security threats and measures.
Good evidence
Will show recent updates consistent with the latest review findings.
- Check 5 of 5What an auditor asks for
Ask for
The budget records for cyber security spending: Request documents that show how cyber security funds have been allocated and used. Look to see if they align with priorities identified in the reviews.
Good evidence
Is evidence of budget adjustments following the review outcomes.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.1.
ISM-1617 calls for the CISO to regularly review and update the cyber security program to ensure its relevance. ISO/IEC 27001:2022 Annex A 5.1 overlaps by requiring periodic reviews of information security policies, including specific ones. While ISM-1617 covers the entire security program, Annex A 5.1 focuses on policy review, a critical component of program governance and renewal.
This control partially overlaps A.5.35.
Annex A 5.35 requires an independent review of the organisation's information security approach and its implementation at planned intervals or after significant change. ISM-1617 relates by requiring the CISO to regularly review and update the cyber security program to keep it relevant to threats and opportunities. Both address periodic review, but ISM-1617 does not require independence and is focused on program maintenance rather than independent assurance over the full ISMS implementation.
ASD Essentials for enterprise IT: 3 mappings
- IT.DET-05.1Periodically review detection coverage for gaps as assets, services and architecture changePartially overlaps
This control partially overlaps IT.DET-05.1.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; ISM-1617 requires the CISO to regularly review and update the cyber security program to keep it relevant to cyber threats, a broader program-level review.
- IT.GOV-04.2Periodically review cyber security resourcing against threat trends, incidents and organisational changePartially overlaps
This control partially overlaps IT.GOV-04.2.
IT.GOV-04.2 requires periodic review of cyber security resourcing against threat trends, incident outcomes and organisational changes; ISM-1617 is a broader review, with the CISO regularly reviewing and updating the cyber security program to keep it relevant to cyber threats.
- IT.RES-04.2Evaluate monitoring coverage and response procedures after incidents and validate improvementsPartially overlaps
This control partially overlaps IT.RES-04.2.
IT.RES-04.2 requires monitoring coverage and incident response procedures to be evaluated after incidents; ISM-1617 requires the CISO to regularly review and update the cyber security program to keep it relevant to cyber threats, a wider review not tied to incidents.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.