ASD ISM 2005 Understanding business criticality of organisation systems
What it says
The board of directors or executive committee understands the business criticality of their organisation's systems, including at least a basic understanding of what systems exist, their value, where they reside, who has access, who might seek access, how they are protected, and how that protection is verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLeaders need to know the importance, location, and protection of critical business systems.
This control ensures that business leaders understand which systems are crucial to their operations, where they are located, and how they are protected. It's important because if executives aren't aware of these systems, they could miss key risks, leading to business disruptions or data breaches.
Free. Save your status, tasks and notes.
Why it matters
If this control is not followed, critical business operations could be disrupted, leading to financial loss and reputational damage.
How to implement
The IT Manager should provide a regular brief to the board explaining which systems are most crucial for business operations.
This can be done by listing key systems, their purpose, location, and any known risks in a simple report.
Security personnel should organise a security audit to identify who has access to each critical system and ensure that only authorised personnel have entry.
They can achieve this by reviewing access logs and updating access permissions as needed.
The business continuity manager should develop clear documentation of where critical systems reside, whether on-site servers, cloud, or third-party providers.
This should include contact details for vendors or third-party support.
Risk management teams should assess the value of each system in terms of business impact if it were to fail, which can be done through an impact assessment workshop with department heads.
Management should verify the security measures protecting critical systems by reviewing performance reports from security tools regularly.
This helps ensure that measures are working and any breaches are quickly addressed.
Keep it running
Regularly review and update who has access to critical systems to ensure that only necessary personnel have permissions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the latest board briefing on critical systems: Request a copy of the report presented to the board.
Look at
the completeness in terms of listed critical systems and the risks involved.
Good evidence
will include detailed descriptions of key systems and identified risks.
- Check 2 of 5What an auditor asks for
Ask for
access control logs: Request documentation showing who has access to critical systems.
Look at
the last audit or update of permissions.
Good evidence
shows updated logs and limited access to authorised personnel only.
- Check 3 of 5What an auditor asks for
Ask for
security audit reports: Request the most recent audit conclusions on system protection measures.
Look at
the scope of the audit covering critical systems.
Good evidence
will have clear findings and actionable recommendations.
- Check 4 of 5What an auditor asks for
Ask for
business impact assessments: Request copies of recent assessments carried out on system failures.
Look at
detailed analyses of potential impacts.
Good evidence
shows clear understanding of consequences of system failures.
- Check 5 of 5What an auditor asks for
Ask for
security performance reports: Request reports from tools monitoring system protection.
Look at
metrics on threat detection and response times.
Good evidence
shows steady monitoring with no major breaches.
Mappings
Closest match in ASD Essentials for enterprise IT: IT.GOV-01.1, Formalise executive and board accountability for cyber security and risk appetite, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control depends on A.5.9.
Annex A 5.9 requires an accurate and maintained inventory of information and associated assets, including ownership. ISM-2005 (Understand Critical Systems and Their Security) is supported by having such an inventory because executives cannot grasp system criticality without reliable records. ISM-2005 focuses on governance and does not directly require a formal inventory.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-01.1Formalise executive and board accountability for cyber security and risk appetitePartially overlaps
This control partially overlaps IT.GOV-01.1.
IT.GOV-01.1 requires formally defined executive and board accountabilities for cyber security and risk appetite; ISM-2005 supports this, requiring the board or executive committee to understand the business criticality of the organisation's systems and how they are protected.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.