ASD ISM 2001 Championing cyber security at an executive level
What it says
The board of directors or executive committee champions a positive cyber security culture within their organisation, including through leading by example.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishExecutives set a good example to promote a healthy cyber security culture in the organisation.
This control is about ensuring the leaders of an organisation promote good cyber security practices by setting a positive example. When executives actively support cyber security, it encourages everyone to follow suit, reducing risks like data breaches or other damaging cyber incidents.
Free. Save your status, tasks and notes.
Why it matters
Without board/executive championing of cyber security, staff follow suit, weakening culture and increasing likelihood of incidents, breaches and losses.
How to implement
Executives should regularly speak about the importance of cyber security during staff meetings.
They can do this by starting each meeting with a brief update on what the organisation is doing to protect its data and why it matters for everyone's work.
HR should integrate cyber security expectations into job descriptions and performance reviews.
This can be done by including specific behaviours or goals related to security, showing that cyber security is part of everyone's job.
Managers should organise regular training sessions on cyber security for employees.
This can involve inviting experts to talk about recent threats and providing practical tips on how to spot phishing emails or secure personal devices.
The IT team should provide executives with regular updates on the organisation's cyber security status.
This involves creating easy-to-understand reports that highlight key threats, recent incidents, and steps being taken, allowing executives to speak knowledgeably about security efforts.
Executives should lead by example by following all cyber security practices themselves.
This includes using strong passwords, not writing them down, and being cautious about the links and attachments they open, showing commitment to security best practices.
Keep it running
Executives/board should visibly lead by example (briefings, messaging, compliance), sponsor security initiatives, and fund priorities to reinforce a positive cyber security culture.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Meeting agendas and minutes where cyber security was discussed.
Look at
These records to see if cyber security topics are consistently included.
Good evidence
Is seeing regular discussions on cyber security initiatives and decisions.
- Check 2 of 5What an auditor asks for
Look at
Sections that mention cyber security responsibilities.
Good evidence
Includes clear expectations for cyber security awareness and actions in these documents.
- Check 3 of 5What an auditor asks for
Ask for
Training records of cyber security sessions attended by employees.
Look at
Attendance lists and materials used during the sessions.
Good evidence
Is consistent participation from staff across all departments with up-to-date training content.
- Check 4 of 5What an auditor asks for
Look at
The clarity and relevance of these reports to ensure they are understandable and relevant to decision-making.
Good evidence
Report is clear, concise, and actionable.
- Check 5 of 5What an auditor asks for
Ask for
To see evidence of executives practising security measures themselves, such as using password managers or security software logs.
Look at
Documented use of security practices by executives.
Good evidence
Is finding records or logs confirming executives' adherence to security protocols.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining information security roles and responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.2.
Annex A 5.2 requires information security roles and responsibilities to be defined and allocated according to organisational needs. ISM-2001 overlaps by assigning an executive/board responsibility to champion cyber security culture, which is part of senior leadership's security role expectations. ISM-2001 is focused on tone-from-the-top and cultural leadership, while Annex A 5.2 is broader governance covering definition and allocation of roles across all levels.
This control partially overlaps A.5.4.
ISM-2001 requires the board or executive committee to champion a positive cyber security culture through visible leadership and example. Annex A 5.4 supports this by requiring management to ensure personnel apply information security in line with established policies and procedures. While Annex A 5.4 is more directive and compliance-oriented for managers, it ties into the leadership tone set by ISM-2001.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.