Skip to content
Cyber security roles
ASD ISMISM-1998

ASD ISM 1998 Integrate cyber security across business functions

What it says

The board of directors or executive committee ensures that cyber security is integrated throughout all business functions within their organisation.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Leaders ensure cyber security is a part of every business area.

This control is about making sure cyber security is part of every part of the business. If cyber security isn't considered everywhere, small mistakes can lead to big problems like data breaches, financial loss, and damage to the business's reputation.

Why it matters

Without board-driven integration across business functions, security becomes siloed, creating inconsistent risk decisions and higher breach likelihood.

How to implement

  1. Business leaders should start by outlining their security expectations across the organisation by holding a meeting with department heads.

    Use this session to explain the importance of cyber security and how each department can play a role. Provide examples relevant to each department's work.

  2. Department heads should identify specific areas where cyber security measures need to be integrated.

    They can do this by reviewing their current processes to pinpoint where sensitive data is accessed or stored. Make a list of these areas and identify potential risks.

  3. Designate a cyber security coordinator in each department.

    This person should work with the IT department to develop a plan to address the specific security needs identified. They can participate in regular training to stay updated on best practices.

  4. Managers should ensure that all department staff receive basic cyber security awareness training.

    This can be accomplished by organising mandatory workshops or e-learning sessions covering key topics like recognising phishing emails and using strong passwords.

  5. Reinforce a culture of security by regularly updating all staff about cyber security policies and any changes.

    Use internal newsletters or team meetings to communicate updates and remind staff of their role in protecting the organisation.

Keep it running

Set executive-owned security KPIs for each business unit and review progress quarterly to keep security embedded in business planning and delivery.

Evidence and audit

  1. Check 1 of 2What an auditor asks for

    Ask for

    The minutes from meetings where security integration was discussed.

    Look at

    The details to see if attendees discussed specific security roles and responsibilities.

    Good evidence

    Includes participant names, roles, agenda topics discussed, and action items.

  2. Check 2 of 2What an auditor asks for

    Ask for

    Documentation on department coordinators and their action plans: Evaluate the plans for specific actions and timelines. A well-documented plan should include coordinator names, actions to improve security, and progress updates.

    Look at

    Training content and attendance records.

    Good evidence

    Training record includes the date, attendees, topics covered, and feedback collected.

Mappings

Closest match in ISO/IEC 27001: A.5.4, Management responsibilities for information security, which this control covers in full and more.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.5.4Management responsibilities for information securityBroader than
  • A.5.8Information security in project managementBroader than
ASD Essentials

ASD Essentials for enterprise IT: 2 mappings

  • IT.GOV-01.1Formalise executive and board accountability for cyber security and risk appetitePartially overlaps
  • IT.GOV-08.1Name an executive accountable for AI use, governance and risk managementPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.