Skip to content
Cyber security roles
ASD ISMISM-1918

ASD ISM 1918 Regular cyber security reporting to audit committee

What it says

The CISO regularly reports directly to their organisation's audit, risk and compliance committee (or equivalent) on cyber security matters.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

The CISO reports cyber security updates directly to the organisation's risk committee.

This control is about the Chief Information Security Officer (CISO) keeping the organisation's audit and risk committee updated on cyber security matters. It's important because regular updates help ensure that top decision-makers are aware of cyber risks and can make informed decisions to protect the organisation from cyber threats.

Why it matters

Without regular CISO reporting to the audit committee, cyber risk oversight weakens, delaying decisions on threats and increasing likelihood and impact of a breach.

How to implement

  1. The CISO should schedule regular meetings with the audit, risk, and compliance committee.

    These should occur at least quarterly to discuss current cyber security issues and upcoming changes that may affect risk levels. The CISO can prepare a simple presentation to outline key points and discuss potential actions.

  2. The IT team should compile regular updates on the organisation's current cyber security posture.

    This involves gathering information on any incidents, potential threats, or system vulnerabilities. Use a simple dashboard or a summary report to make the information easy to understand and report to the CISO.

  3. The risk committee members need to be educated on common cyber security terms and issues.

    The CISO can set up brief training sessions or provide reading material that explains these concepts in simple language, helping committee members understand the reports fully.

  4. The organisation should maintain clear communication channels between the IT department and the audit committee.

    The IT manager should regularly provide insights or flags of any significant concerns that need the committee's attention, using email or scheduled meetings.

  5. Audit committee members should have access to past cyber security incident reports to understand trends over time.

    The CISO can facilitate this by organising reports into an accessible repository, such as a shared drive or database, where members can review them.

Keep it running

Schedule CISO updates to the audit/risk committee with a standing agenda: current threats, incidents, control gaps, and risk acceptance decisions with owners and due dates.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The meeting minutes from audit committee updates.

    Look at

    The content to ensure cyber security was discussed.

    Good evidence

    Is minutes showing regular discussion on security issues, risks, and decisions made by the committee.

  2. Check 2 of 5What an auditor asks for

    Ask for

    The CISO's presentation materials used during meetings: Review these for key topics like incident statistics, risk assessments, and mitigation strategies.

    Good evidence

    Presentation will clearly outline current security issues and actionable insights for the committee.

  3. Check 3 of 5What an auditor asks for

    Ask for

    The incident reports summarised in meetings.

    Look at

    How the reports cover the incidents, actions taken, and outcomes.

    Good evidence

    Report contains specific cases and resolutions that align with stated security strategies.

  4. Check 4 of 5What an auditor asks for

    Ask for

    The committee members if they felt informed enough about the cyber security matters: Listen for feedback on the clarity and usefulness of information provided by the CISO.

    Good evidence

    Indicates they understood the information and felt capable of making informed decisions.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Evidence of CISO's preparation for meetings.

    Look at

    Outlines or meeting agendas prepared by the CISO.

    Good evidence

    Agenda will include all key topics intended for discussion and align with the known risks and organisational priorities.

Mappings

Closest match in ISO/IEC 27001: A.5.35, Independent review of information security, which partially overlaps with this control.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.35Independent review of information securityPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.