ASD ISM 2006 Board plans for major cyber security incidents
What it says
The board of directors or executive committee plans for major cyber security incidents, including by participating in exercises, and understands their duties in relation to such cyber security incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe board prepares for major cyber attacks by joining practice drills and knowing their responsibilities.
This control ensures that the board of directors or executive committee are actively involved in planning for significant cyber security incidents. It matters because if they are caught unprepared, a major cyber attack could lead to severe business disruptions and damage to the organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Without board involvement, a major cyber incident may be poorly managed, leading to prolonged downtime, data loss, and reputational damage.
How to implement
Board members should participate in scheduled cyber security incident drills.
Coordinate these with the IT and security teams to simulate potential breach scenarios and determine appropriate responses.
The executive committee should review and understand the organisation's incident response plan.
This should involve a meeting with the cyber security manager to walk through the plan's key steps and ensure clarity on the roles and responsibilities.
Appoint a board member to take the lead on cyber security issues.
This person can regularly liaise with the organisation's security experts to stay updated on potential threats and response strategies.
The CEO should organise regular briefings for the board on cyber security trends and risks.
Invite external experts to present and provide insights on emerging threats and mitigation strategies.
Create a clear communication plan involving the board for use during a cyber incident.
The communication officer should draft this plan, detailing who needs to be informed about incidents and how information is disseminated swiftly and accurately.
Keep it running
Regularly update and rehearse the incident response plan with the board's involvement to maintain preparedness and effective communication.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for records of board meeting minutes related to cyber security drills and exercises.
Look at
Look for detailed notes of attendance and the actions agreed upon during or after each exercise.
Good evidence
Minutes document board or executive committee participation and decision-making on incident handling.
- Check 2 of 5What an auditor asks for
Ask for
Request the organisation's cyber incident response plan.
Look at
Check that it includes board and executive involvement across a range of major incident scenarios.
Good evidence
The plan outlines clear roles and duties for board members during a major cyber security incident.
- Check 3 of 5What an auditor asks for
Ask for
Inquire about past cyber security briefing sessions held for the board.
Look at
Look at the agenda and the list of topics covered in each session.
Good evidence
Briefings are held regularly and cover emerging threats and the board's duties in relation to major incidents.
- Check 4 of 5What an auditor asks for
Ask for
Ask for a list of board members and their designated security roles.
Look at
Verify that one member is clearly assigned responsibility for cyber security issues.
Good evidence
The designation is confirmed in writing with clear responsibilities for that member.
- Check 5 of 5What an auditor asks for
Ask for
Request the communication plan for incident response involving the board.
Look at
Examine the clarity and thoroughness of the steps outlined in the document.
Good evidence
The plan details communication workflows and the responsible parties for keeping the board informed during an incident.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining information security roles and responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 4 mappings
This control partially overlaps A.5.2.
ISM-2006 requires the board/executive committee to understand their duties in relation to major cyber security incidents and to participate in preparedness activities. Annex A 5.2 requires information security roles and responsibilities to be defined and allocated across the organisation. They overlap in clarifying responsibilities, but ISM-2006 is specifically about executive/board duties and exercising for major incidents, while Annex A 5.2 is organisation-wide and not incident-specific.
This control partially overlaps A.5.24.
ISM-2006 requires the board/executive committee to plan and practise for major cyber security incidents (e.g. participate in exercises) and understand their duties. Annex A 5.24 requires the organisation to plan and prepare incident management processes, including defining roles and responsibilities and communicating them. They overlap on incident preparedness and clarifying responsibilities, but ISM-2006 is explicitly executive-governance focused and exercise participation, whereas Annex A 5.24 is broader across the whole incident management framework and operational roles.
This control supports A.5.26.
ISM-2006 requires executives to plan for major cyber incidents and practise their response so they understand their duties. Annex A 5.26 requires incidents to be responded to in accordance with documented procedures. Executive planning and exercising in ISM-2006 strengthens and reinforces consistent execution of documented response procedures, but it does not itself define the operational procedures required by Annex A 5.26.
This control supports A.5.29.
Annex A 5.29 requires the organisation to plan for maintaining information security at an appropriate level during disruptions. ISM-2006 supports this by ensuring executive leadership plans for major cyber security incidents and participates in exercises, improving governance, decision making and readiness during disruptive events. ISM-2006 is focused on board/executive preparedness for cyber incidents, while Annex A 5.29 covers the full set of disruption scenarios and the operational arrangements needed to sustain security controls.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.