ASD ISM 1966CISO Manages and Verifies System Register
Official control statement
The CISO develops, implements, maintains and regularly verifies a register of systems used by their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
The CISO keeps and checks a list of all the systems the organisation uses.
What this means in practice
The Chief Information Security Officer (CISO) needs to have and regularly check a complete list of all computer systems the organisation uses. This is important because without an accurate list, systems could go unmanaged and become susceptible to security threats or failures without anyone knowing.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
June 2026
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for cyber security rolesTopic
Overseeing the cyber security program
Why it matters
Without a verified system register, vulnerabilities may remain unnoticed, leading to cyber security breaches, data loss, or system failures.
Operational notes
Keep the system register updated continuously through regular communication between departments, HR, and IT to uphold cyber security standards.
Implementation tips
- The CISO should assign someone to compile a list of every system the organisation uses. Work with IT and department heads to identify systems used across various departments and ensure the list is thorough.
- The IT team should maintain and update the system list regularly. Designate a team member to check the list every month for any changes like new systems being added or old ones being removed.
- Department managers should inform the IT team about any new systems they start using. Create a simple form for managers to fill out any time they add or plan to retire a system.
- HR should ensure any employee onboarding or offboarding includes a review of the systems they may have access to. This helps keep the system register accurate and up-to-date.
- The CISO should review the system register with security staff quarterly. This review ensures every system on the list complies with security policies and any necessary updates or precautions are in place.
Audit / evidence tips
- AskAsk for the current system register maintained by the CISO.Look atCheck that it contains a comprehensive list of all systems used by the organisation, with details such as system name, purpose and owning department.GoodA complete, current register exists with the CISO as its owner and every in-scope system recorded with the expected details.
- AskAsk for the update logs or change history of the system register.Look atCheck how frequently updates occur and whether they record changes such as newly added systems or decommissioned ones.GoodThe logs show the register is actively maintained, with additions and removals recorded promptly as systems change.
- AskAsk for records of the regular (for example quarterly) reviews of the system register.Look atVerify there is a documented review between the CISO and the security team covering the register and any resulting actions.GoodReviews are documented at a regular cadence, led or verified by the CISO, with actions tracked to completion.
- AskAsk for the communication records showing how departments report new systems to IT.Look atConfirm departments report new systems through established forms or emails, and that these feed into the register.GoodCommunication records show consistent and timely reporting of new systems, reflected in corresponding register updates.
- AskAsk for audit or verification reports that compare the register against systems actually in use.Look atInspect the reports to see whether the register aligns accurately with real-world systems and how discrepancies were handled.GoodVerification reports show the register matches actual use, with any discrepancies identified and corrected by the CISO.
Cross-framework mappings
How ISM-1966 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 5.9 | Annex A 5.9 requires maintaining an inventory of information and associated assets, including ownership | |
E8
| Control | Notes | Details |
|---|---|---|
extensionDepends on(1)expand_less | ||
| E8-PA-ML1.1 | ISM-1966 requires the CISO to maintain and regularly verify a register of organisational systems | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Cyber security roles
See all Guidelines for cyber security roles controls, or browse the full ASD ISM library.