ASD ISM 1997 Define cyber security roles for leadership
What it says
The board of directors or executive committee defines clear roles and responsibilities for cyber security both within the board of directors or executive committee and broadly within their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe board sets specific cyber security roles and duties for themselves and the whole organisation.
It's essential for the board of directors or top executives to clearly define who is responsible for different aspects of cyber security within the company. If this isn't done, responsibilities can fall through the cracks, meaning potential security threats might not be managed properly, leading to data breaches or financial losses.
Free. Save your status, tasks and notes.
Why it matters
Undefined cyber security roles at board/executive level create governance gaps, weakening oversight and increasing risk of strategic security incidents.
How to implement
Board members should identify key areas of cyber security risk: The board needs to sit down and list out all the major cyber threats that could impact the business.
Doing a simple brainstorming session can help, where they collectively consider what could go wrong and what part of the business would be affected.
Executives should assign specific cyber security responsibilities: Each executive or board member should be assigned specific duties, like overseeing data protection or ensuring systems stay updated.
This can be done by discussing individual strengths and aligning responsibilities with those strengths.
Organisational leaders should communicate these roles: Once roles are defined at the top, communicate them clearly to the entire organisation.
This could be done through a company-wide email or a presentation at an all-hands meeting where everyone understands who handles what.
The board should provide clear protocols for reporting issues: Establish straightforward steps for employees to report any suspicious activity or security concerns.
This might be as simple as setting up a dedicated email or a hotline number everyone knows about.
Leadership should review roles and responsibilities regularly: Set a schedule for revisiting these roles, perhaps quarterly, to ensure they remain relevant and effective.
Use these meetings to assess how well responsibilities are being met and adjust as needed.
Keep it running
Maintain a board/executive RACI for cyber security; assign named owners for oversight, risk appetite, reporting cadence, and major security decisions, and review quarterly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The cyber security roles and responsibilities document: Request to see the official document that details each board member's or executive's responsibilities.
Look at
Whether each role is clearly defined and linked to a specific security task.
Good evidence
Includes a dated document with individual names and their specific duties.
- Check 2 of 5What an auditor asks for
Look at
Specific decisions made and tasks assigned.
Good evidence
Includes detailed minutes with action items and a follow-up plan.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of internal communication about these roles: Request to see the emails or announcements sent out to staff about board-assigned responsibilities.
Look at
Clarity and completeness in the communication.
Good evidence
Shows clear internal messaging with a copy of the email or presentation slides.
- Check 4 of 5What an auditor asks for
Ask for
Documents that describe how incidents should be reported by staff. Examine the instructions for clarity and accessibility.
Good evidence
Will show simple, actionable steps that any employee can follow.
- Check 5 of 5What an auditor asks for
Look at
Regular intervals noted and actual meeting records.
Good evidence
Indicates these meetings happen regularly and include feedback.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining information security roles and responsibilities, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control is equivalent to A.5.2.
ISM-1997 requires the board or executive committee to define clear cyber security roles and responsibilities across the organisation, including within leadership. Annex A 5.2 likewise requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-1997 is more explicit about board/executive ownership, but the core requirement (clear definition and allocation of security roles) is substantially the same.
This control partially overlaps A.5.24.
ISM-1997 requires the board or executive committee to define clear cyber security roles and responsibilities across the organisation. Annex A 5.24 requires defining and communicating incident management processes, roles and responsibilities for handling information security incidents. They overlap on the need to define and communicate roles, but Annex A 5.24 is limited to incident management whereas ISM-1997 covers cyber security leadership roles more broadly.
ISO/IEC 42001: 1 mapping
This control is broader than A.3.2.
Annex A 3.2 requires defining and allocating roles and responsibilities for AI. ISM-1997 requires clear roles and responsibilities for cyber security. Annex A 3.2 is narrower as it focuses specifically on AI roles, while ISM-1997 covers organisation-wide cyber security roles.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-01.1Formalise executive and board accountability for cyber security and risk appetitePartially overlaps
This control partially overlaps IT.GOV-01.1.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security and risk appetite; ISM-1997 covers defining roles, requiring the board or executive committee to set clear cyber security roles and responsibilities for itself and the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.