ASD ISM 2000 Regular cyber security briefings for executives
What it says
The board of directors or executive committee seeks regular briefings or reporting on the cyber security posture of their organisation, as well as the threat environment in which they operate, from internal and external subject matter experts.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishExecutives receive regular updates on cyber security and threats from experts.
This control is about making sure that the leaders of an organisation get regular updates from cyber security experts about the current risks and how well the organisation is protected. This is important because without these updates, executives might not realise emerging threats or weaknesses, which could lead to significant financial loss, reputational damage, or legal issues if a cyber attack occurs.
Free. Save your status, tasks and notes.
Why it matters
Without regular board/executive cyber briefings, leaders may miss posture and threat trends, delaying decisions and increasing breach, loss, and reputational damage risk.
How to implement
Executives should schedule regular briefing sessions with internal IT experts: They can set up monthly or quarterly meetings where cyber security updates are presented.
These sessions should include a summary of recent incidents, current threats, and recommendations for any improvements.
Appoint a dedicated IT manager to coordinate the briefings: This person is responsible for collecting and analysing the necessary security data.
They should work with both in-house staff and trusted external advisers to prepare clear and concise reports.
Use visual aids to present information: The IT manager should prepare easy-to-understand visuals like graphs or infographics showing trends in threats and the organisation's security posture over time.
This helps non-technical executives quickly grasp important points.
Encourage executives to ask questions during briefings: Create an open environment where executives feel comfortable asking for clarification on security matters.
The IT manager should provide clear, jargon-free answers to enhance understanding and engagement.
Keep it running
Schedule board/executive committee briefings (e.g., quarterly) covering security posture, key incidents, risk metrics and current threat environment, using internal and external SMEs.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The schedule of past and upcoming executive security briefings: Ensure the schedule includes attendees, dates, and meeting agendas.
Look at
Regular meetings at consistent intervals showing proactive engagement.
Good evidence
Includes a clear record demonstrating consistent and structured briefing attendance by executives.
- Check 2 of 4What an auditor asks for
Ask for
The presentation slides or reports used during these briefings: Check for comprehensiveness, clarity, and relevance of the detailed content. Good slides include summaries of key risks, incidents, and action points in plain language.
Look at
Evidence of executive engagement, such as questions asked or action points noted.
Good evidence
Includes evidence of executive participation and decisions made during the meetings.
- Check 3 of 4What an auditor asks for
Ask for
Evidence of collaboration with external experts.
Look at
Contracts, reports, or meeting notes from engagements with outside consultants.
Good evidence
Includes recent reports or emails confirming that an external review has been conducted.
- Check 4 of 4What an auditor asks for
Ask for
Follow-up actions list resulting from these briefings.
Look at
Documented tasks assigned to different stakeholders with deadlines and completion status.
Good evidence
Has a clear list showing tasks are being tracked and acted upon.
Mappings
Closest match in ISO/IEC 27001: A.5.6, Contact with special interest groups, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.6.
Annex A 5.6 requires the organisation to establish and maintain ongoing contact with special interest groups and specialist security forums/professional associations. ISM-2000 requires executives to seek regular briefings on cyber posture and the threat environment from internal and external subject matter experts, which can be satisfied in part through sustained relationships with external security communities and professional networks. ISM-2000 is oriented to executive assurance and reporting rather than explicitly requiring organisational participation/contacts with security forums, so the overlap is partial.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-01.1Formalise executive and board accountability for cyber security and risk appetitePartially overlaps
This control partially overlaps IT.GOV-01.1.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security, including monitoring risk appetite; ISM-2000 supports that monitoring, with the board or executive committee seeking regular briefings on cyber security posture and the threat environment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.