ASD ISM 2002 Ensure board cyber security literacy for compliance
What it says
The board of directors or executive committee maintains a sufficient level of cyber security literacy to fulfil both their fiduciary duties and any legislative or regulatory obligations.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishExecutive leaders must understand cyber security to meet legal and regulatory responsibilities.
This control means that the board of directors or top executives need to understand enough about cyber security to make informed decisions and ensure the company complies with laws and regulations. If they don't, the organisation could face legal penalties, financial losses, or damage to its reputation if a cyber attack occurs.
Free. Save your status, tasks and notes.
Why it matters
Lack of board cyber literacy can lead to uninformed decisions, resulting in regulatory breaches and severe reputational and financial harm.
How to implement
Board Chair should organise regular cyber security training sessions.
Work with a qualified cyber security professional to deliver workshops tailored to the organisation's needs, explaining current cyber threats and how they impact the business.
CEO should ensure a cyber security expert is present at board meetings.
Invite a knowledgeable internal or external adviser to discuss cyber risks and strategies in straightforward terms, enabling informed decision-making.
HR should incorporate cyber security awareness into the onboarding process for new executives.
Develop a program that introduces essential concepts and responsibilities related to cyber security, using simple examples and case studies.
Chief Information Officer should provide monthly updates on cyber security matters to the board.
Prepare written reports and in-person briefings that summarise recent incidents, upcoming threats, and the measures taken to safeguard the organisation.
Legal Counsel should review the organisation's obligations under current cyber security laws and regulations.
Given the board a summary document explaining these responsibilities clearly and highlight any changes or updates required.
Keep it running
Provide quarterly board briefings on cyber risk, regulatory duties and incidents; record attendance and actions to evidence literacy.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The latest board meeting minutes.
Look at
Sections discussing cyber security awareness or literacy activities. Good minutes should reflect informed discussions on cyber risks and related decisions.
- Check 2 of 5What an auditor asks for
Ask for
Training records of board members.
Look at
Attendance and content of each session covering cyber security topics.
Good evidence
Record shows regular participation of members in sessions that are relevant to current threats and regulatory requirements.
- Check 3 of 5What an auditor asks for
Ask for
Any external advisory reports presented to the board.
Look at
How these reports address specific cyber risks and offer tailored recommendations. Good reports will show actionable insights that have been discussed and considered.
- Check 4 of 5What an auditor asks for
Ask for
The organisation's cyber security policy: Look particularly at the involvement of executive leaders in the policy creation and review process.
Good evidence
Policy will have clear input from the board and be updated with emerging threats and compliance needs.
- Check 5 of 5What an auditor asks for
Ask for
A summary of laws and regulations relating to cyber security compliance reviewed by the board.
Look at
How these are regularly updated and communicated to the board.
Good evidence
Summary should detail the board's understanding and steps taken to remain compliant.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.3.
ISM-2002 requires the board of directors or executive committee to maintain enough cyber security literacy to meet its fiduciary duties and legislative or regulatory obligations. Annex A 6.3 requires personnel and relevant interested parties to receive awareness, education and training suited to their role, and board literacy is typically built and maintained through that education. ISM-2002 applies only to the board or executive and focuses on governance-level literacy, whereas Annex A 6.3 covers all personnel and includes regular policy updates.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-08.1Name an executive accountable for AI use, governance and risk managementPartially overlaps
This control partially overlaps IT.GOV-08.1.
IT.GOV-08.1 requires executive accountability for the use, governance and risk management of artificial intelligence; ISM-2002 supports this by requiring the board or executive committee to maintain sufficient cyber security literacy for its fiduciary and regulatory obligations.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.