Skip to content
OT principles
ASD Essentials

Essentials for OT

GOV-01 Executive cyber security accountability

one actionAlso in ASD Essentials for enterprise IT

The board and executives must own OT cyber security. Write down what they are accountable for, including deciding, watching and adjusting how much risk the organisation will accept. Review these accountabilities on a set schedule.

Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026

The principle

The board of directors or executive committee is accountable for cyber security.

ASD, Information Security Manual (ISM), Principle GOV-01

The action

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

  1. Action 1 of 1

    Formally define and establish executive and board-level accountabilities for OT cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.

    In plain English: Formally define and establish the board's and executives' OT cyber security accountabilities, including setting, watching and adjusting risk appetite. Review them on a set schedule.

    Domains
    Governance and culture

See all 34 principles in Essentials for OT, or read our OT guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.