ASD ISM 2000Regular Cyber Security Briefings for Executives
Official control statement
The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of their organisation, as well as the threat environment in which they operate, from internal and external subject matter experts.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Executives receive regular updates on cyber security and threats from experts.
What this means in practice
This control is about making sure that the leaders of an organisation get regular updates from cyber security experts about the current risks and how well the organisation is protected. This is important because without these updates, executives might not realise emerging threats or weaknesses, which could lead to significant financial loss, reputational damage, or legal issues if a cyber attack occurs.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for cyber security rolesTopic
Embedding cyber security
Why it matters
Without regular board/executive cyber briefings, leaders may miss posture and threat trends, delaying decisions and increasing breach, loss, and reputational damage risk.
Operational notes
Schedule board/executive committee briefings (e.g., quarterly) covering security posture, key incidents, risk metrics and current threat environment, using internal and external SMEs.
Implementation tips
- Executives should schedule regular briefing sessions with internal IT experts: They can set up monthly or quarterly meetings where cyber security updates are presented. These sessions should include a summary of recent incidents, current threats, and recommendations for any improvements.
- Appoint a dedicated IT manager to coordinate the briefings: This person is responsible for collecting and analysing the necessary security data. They should work with both in-house staff and trusted external advisers to prepare clear and concise reports.
- Use visual aids to present information: The IT manager should prepare easy-to-understand visuals like graphs or infographics showing trends in threats and the organisation's security posture over time. This helps non-technical executives quickly grasp important points.
- Encourage executives to ask questions during briefings: Create an open environment where executives feel comfortable asking for clarification on security matters. The IT manager should provide clear, jargon-free answers to enhance understanding and engagement.
Audit / evidence tips
- AskThe schedule of past and upcoming executive security briefings: Ensure the schedule includes attendees, dates, and meeting agendasLook atRegular meetings at consistent intervals showing proactive engagementGoodIncludes a clear record demonstrating consistent and structured briefing attendance by executives
- AskThe presentation slides or reports used during these briefings: Check for comprehensiveness, clarity, and relevance of the detailed content. Good slides include summaries of key risks, incidents, and action points in plain language
- Look atEvidence of executive engagement, such as questions asked or action points notedGoodIncludes evidence of executive participation and decisions made during the meetings
- AskEvidence of collaboration with external expertsLook atContracts, reports, or meeting notes from engagements with outside consultantsGoodIncludes recent reports or emails confirming that an external review has been conducted
- AskFollow-up actions list resulting from these briefingsLook atDocumented tasks assigned to different stakeholders with deadlines and completion statusGoodHas a clear list showing tasks are being tracked and acted upon
Cross-framework mappings
How ISM-2000 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 5.6 | Annex A 5.6 requires the organisation to establish and maintain ongoing contact with special interest groups and specialist security foru... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Cyber security roles
See all Guidelines for cyber security roles controls, or browse the full ASD ISM library.