ASD ISM 1966 CISO manages and verifies system register
What it says
The CISO develops, implements, maintains and regularly verifies a register of systems used by their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO keeps and checks a list of all the systems the organisation uses.
The Chief Information Security Officer (CISO) needs to have and regularly check a complete list of all computer systems the organisation uses. This is important because without an accurate list, systems could go unmanaged and become susceptible to security threats or failures without anyone knowing.
Free. Save your status, tasks and notes.
Why it matters
Without a verified system register, vulnerabilities may remain unnoticed, leading to cyber security breaches, data loss, or system failures.
How to implement
The CISO should assign someone to compile a list of every system the organisation uses.
Work with IT and department heads to identify systems used across various departments and ensure the list is thorough.
The IT team should maintain and update the system list regularly.
Designate a team member to check the list every month for any changes like new systems being added or old ones being removed.
Department managers should inform the IT team about any new systems they start using.
Create a simple form for managers to fill out any time they add or plan to retire a system.
HR should ensure any employee onboarding or offboarding includes a review of the systems they may have access to.
This helps keep the system register accurate and up-to-date.
The CISO should review the system register with security staff quarterly.
This review ensures every system on the list complies with security policies and any necessary updates or precautions are in place.
Keep it running
Keep the system register updated continuously through regular communication between departments, HR, and IT to uphold cyber security standards.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the current system register maintained by the CISO.
Look at
Check that it contains a comprehensive list of all systems used by the organisation, with details such as system name, purpose and owning department.
Good evidence
A complete, current register exists with the CISO as its owner and every in-scope system recorded with the expected details.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the update logs or change history of the system register.
Look at
Check how frequently updates occur and whether they record changes such as newly added systems or decommissioned ones.
Good evidence
The logs show the register is actively maintained, with additions and removals recorded promptly as systems change.
- Check 3 of 5What an auditor asks for
Ask for
Ask for records of the regular (for example quarterly) reviews of the system register.
Look at
Verify there is a documented review between the CISO and the security team covering the register and any resulting actions.
Good evidence
Reviews are documented at a regular cadence, led or verified by the CISO, with actions tracked to completion.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the communication records showing how departments report new systems to IT.
Look at
Confirm departments report new systems through established forms or emails, and that these feed into the register.
Good evidence
Communication records show consistent and timely reporting of new systems, reflected in corresponding register updates.
- Check 5 of 5What an auditor asks for
Ask for
Ask for audit or verification reports that compare the register against systems actually in use.
Look at
Inspect the reports to see whether the register aligns accurately with real-world systems and how discrepancies were handled.
Good evidence
Verification reports show the register matches actual use, with any discrepancies identified and corrected by the CISO.
Mappings
Closest match in ISO/IEC 27001: A.5.9, Inventory management of information and associated assets, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.9.
Annex A 5.9 requires maintaining an inventory of information and associated assets, including ownership. ISM-1966 (Register Management of Organisational Systems) overlaps by requiring a maintained and regularly verified register of systems, which is a major subset of asset inventory. However, it is limited to systems and assigns responsibility to the CISO, while Annex A 5.9 extends to various asset classes.
ASD Essential Eight: 1 mapping
This control depends on E8-PA-ML1.1.
ISM-1966 requires the CISO to maintain and regularly verify a register of organisational systems. E8-PA-ML1.1 involves automated asset discovery to detect assets for vulnerability scanning, which assists in keeping the ISM-1966 register accurate. E8-PA-ML1.1 focuses on discovery for scanning, whereas ISM-1966 does not prescribe any specific asset discovery mechanisms.
ASD Essentials for enterprise IT: 2 mappings
- IT.IDE-01.1Use an approved inventory with automated discovery of new and changed assetsPartially overlaps
This control partially overlaps IT.IDE-01.1.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; ISM-1966 overlaps at system level, with the CISO developing, maintaining and regularly verifying a register of the organisation's systems.
- IT.IDE-01.2Keep current records of infrastructure, software, identities, credentials and dataPartially overlaps
This control partially overlaps IT.IDE-01.2.
IT.IDE-01.2 requires current records of infrastructure, operating systems, applications, identities, credentials and data assets; ISM-1966 overlaps at system level, with the CISO developing, maintaining and regularly verifying a register of the organisation's systems.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.