ASD ISM 1999 Align cyber security with business strategy
What it says
The board of directors or executive committee ensures the cyber security strategy for their organisation is aligned with the overarching strategic direction and business strategy for their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLeadership ensures cyber security strategy aligns with the company's overall business direction.
Aligning your cyber security strategy with your business goals is like making sure your seatbelt matches your speed. If the two aren't in sync, you could end up with serious problems, like breaches that cost you money, damage your reputation, or even halt your business operations.
Free. Save your status, tasks and notes.
Why it matters
Without board/executive alignment, cyber security strategy may not support business priorities, leading to misdirected investment, unmanaged risk and delivery delays.
How to implement
Board members should hold a strategy alignment session: Conduct a meeting where key leaders discuss how current cyber security measures support and protect business goals.
During the meeting, encourage open dialogue to identify gaps and areas of improvement.
Executives should map out the business objectives: They need to list key objectives of the organisation and check if current cyber security strategies help achieve these.
Use simple charts or bullet points to compare each business goal with the cyber security measure that protects it.
IT managers should present cyber risks in business terms: Prepare an overview of the potential cyber risks that could impact business operations and discuss these in business language during executive meetings.
Avoid technical jargon to ensure clarity and understanding amongst all stakeholders.
The cyber security team should tailor security policies: They ought to update existing policies to ensure they directly support business priorities.
This involves consulting with business units to understand specific needs and aligning policies to meet these requirements effectively.
Organisational leaders should regularly review and adjust strategies: Plan for routine assessment of how well the cyber security strategy aligns with business objectives.
Use simple checklists and updates in leadership meetings to make necessary adjustments based on new threats or business changes.
Keep it running
At least annually, have the board/executive committee approve a cyber security strategy mapped to business objectives, risk appetite and major programs; track KPIs and reprioritise funding as strategy changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The strategy alignment meeting notes: Request the documented notes from meetings where cyber security and business strategy alignment was discussed.
Look at
The actions decided and who is responsible for each.
Good evidence
Includes well-documented minutes with clear actions and accountability assigned to each participant.
- Check 2 of 5What an auditor asks for
Ask for
A list of business objectives with associated cyber measures: Request documentation that pairs business goals with specific cyber security practices.
Look at
A clear connection between objectives and security actions.
Good evidence
Displays a comprehensive, easily understandable document where all objectives have thought-out corresponding security measures.
- Check 3 of 5What an auditor asks for
Ask for
Records of risk presentations made to the executive team: Request slides or summaries that present cyber risks in business terms as shown to executives.
Look at
How the risks are explained without relying on technical jargon.
Good evidence
Is a presentation that clearly ties specific cyber risks to business operations and highlights potential impacts.
- Check 4 of 5What an auditor asks for
Ask for
Updated cyber security policy documents: Request the latest version of security policies to see if they reflect business aims and objectives.
Look at
References to specific business needs and priorities.
Good evidence
Includes policies that clearly mention and support identified business goals.
- Check 5 of 5What an auditor asks for
Ask for
The review cycle documentation: Request evidence of regular reviews of cyber security alignment with business strategies, like a scheduled calendar or meeting notes.
Look at
Details on what adjustments were made and why.
Good evidence
Shows a consistent review process and includes decisions that adapt to changing business or threat landscapes.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.1.
ISM-1999 requires the board or executive committee to ensure the organisation's cyber security strategy aligns with the overarching strategic direction and business strategy. Annex A 5.1 requires information security policies to be defined, approved by management, communicated, acknowledged, and reviewed. They overlap because aligned strategy (ISM-1999) typically drives the security policy framework (Annex A 5.1) and ensures policies support business objectives. However, Annex A 5.1 is focused on the policy lifecycle and communication, while ISM-1999 is governance-level alignment rather than policy mechanics.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-01.1Formalise executive and board accountability for cyber security and risk appetitePartially overlaps
This control partially overlaps IT.GOV-01.1.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security and risk appetite; ISM-1999 gives one concrete accountability, with the board or executive committee ensuring the cyber security strategy aligns with the organisation's business strategy.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.