Skip to content
Cloud principles
ASD Essentials

Essentials for cloud

GOV-01 Executive cyber security accountability

one actionAlso in ASD Essentials for enterprise IT

Your board or executive team should formally own cyber security. Write down what they answer for, including setting, checking and adjusting how much risk the organisation will accept (its risk appetite). Review those duties on a set schedule.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

The board of directors or executive committee is accountable for cyber security.

ASD, Information Security Manual (ISM), Principle GOV-01

The action

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

  • C: Customer
  • S: Supplied
  • P: Provider-inherited

  1. Action 1 of 1

    Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.

    In plain English: Formally set out what your board and executives answer for in cyber security, including setting, checking and adjusting your risk appetite. Review this on a set schedule.

    Domains
    Governance and culture
    Who does it
    PaaSCustomer
    SaaSCustomer

See all 30 principles in Essentials for cloud, or read our cloud guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.