Guidelines for cyber security documentation

Ensure there is a continuous and effective plan for safeguarding cyber activities and data.

Cyber security documents need approval from the chief security officer or system officer based on their scope.

Cyber security documentation is reviewed at least annually and includes a 'current as at \[date\]' or equivalent statement.

Make sure all stakeholders are informed about cyber security documents and their updates.

Ensure system security plans are approved before starting system development.

Every system needs a written security plan describing what it is for, where it starts and ends, who runs it, and an annex listing the ISM controls and any extra controls in place.

Create a plan detailing how to handle and report cyber security incidents effectively.

Ensure systems have a plan for managing changes, including approvals and notifications for both routine and urgent updates.

Each system must have a written continuous monitoring plan that covers three things: (1) running security assessment activities to find vulnerabilities (weaknesses an attacker could exploit), (2) analysing each vulnerability found to work out its potential impact, and (3) putting fixes (mitigations) in place, choosing which ones based on risk, how effective they are, and how much they cost. The goal is an ongoing cycle of find, assess, and fix, rather than a one-off security check.

When a system's security control assessment finishes, the assessor writes a report setting out scope, strengths and weaknesses, operating risks, control effectiveness and recommended fixes.

When a security control assessment of a system finishes, the system owner writes up a plan of action and milestones so the findings turn into tracked, dated remediation work.