Guidelines for cyber security roles

The board sets specific cyber security roles and duties for themselves and the whole organisation.

Leaders ensure cyber security is a part of every business area.

Leadership ensures cyber security strategy aligns with the company's overall business direction.

Executives receive regular updates on cyber security and threats from experts.

Executives set a good example to promote a healthy cyber security culture in the organisation.

Executive leaders must understand cyber security to meet legal and regulatory responsibilities.

Executives should stay informed on hiring and skills gaps in their cyber security team.

The board supports cyber security training for all staff using internal and external opportunities.

Leaders need to know the importance, location, and protection of critical business systems.

The board prepares for major cyber attacks by joining practice drills and knowing their responsibilities.

The organisation must appoint a Chief Information Security Officer (CISO) who provides cyber security leadership and guidance. This leadership role must cover both Information Technology (IT, the systems that handle data, email and business applications) and Operational Technology (OT, the systems that monitor or control physical equipment, such as machinery, building services or industrial processes). The CISO is the named senior person accountable for setting direction, coordinating effort and advising the organisation on protecting both of these environments.

The CISO is in charge of managing the organisation's cyber security staff.

The CISO must regularly update the board or executive committee on cyber security issues.

The CISO creates and updates a strategy to share the organisation's cyber security goals effectively.

The CISO sets up metrics and indicators to measure and track cyber security performance in the organisation.

The CISO aligns cyber security with business by regularly meeting with a dedicated committee of key executives.

The CISO ensures business and security teams work together effectively on managing security risks.

The CISO is responsible for managing risks in their organisation's cyber supply chain.

The CISO is responsible for handling the organisation's dedicated cyber security funds.

The CISO should be informed about all cyber security incidents in the organisation.

The CISO helps to ensure recovery plans are in place to maintain essential services during a disaster.

The CISO oversees the development, implementation and maintenance of the organisation's cyber security awareness training program.

The CISO is responsible for managing the organisation's cyber security and ensuring compliance with relevant standards and laws.

The CISO ensures the cyber security program stays relevant to combat threats and seize opportunities.

The CISO is responsible for managing the organisation's reactions to cyber security threats.

The CISO reports cyber security updates directly to the organisation's risk committee.

The CISO keeps and checks a list of all the systems the organisation uses.

The CISO must recruit qualified cyber security staff to support the organisation's activities.

System owners, consulting the authorising officer, work out which extra security controls each system needs given its nature, its environment and how much risk the organisation will accept.

System owners must get permission from an authorising officer to operate certain systems.

Every system should have a specific person responsible for managing it.

System owners work with authorising officers to assess threats and risks for each system.

System owners must register their systems with the designated authorising officer for oversight.

Each system's owner keeps watching its security posture after go-live, and keeps its cyber threats, security risks and security controls under active management rather than reviewing them once.

System owners must annually report each system's security status to an authorising officer.

System owners, in consultation with the authorising officer, must define each system's boundary, business criticality, and security and resilience objectives based on an assessment of compromise impact.

Each system's owner works with its authorising officer to choose the security controls that apply and adjust them so the system meets its security and resilience goals.

The person accountable for a system must actually put its agreed security controls in place, covering both the system itself and the environment it runs in.

System owners, working with the authorising officer, get each non-classified to SECRET system and its environment assessed by their organisation's own assessors or IRAP assessors to confirm controls are in place and working.

TOP SECRET systems (including SCI systems) and their operating environments must be assessed by ASD assessors or delegates, arranged by system owners with the authorising officer.

System owners must get official approval to operate TOP SECRET systems from the Director-General ASD.

System owners should limit data collection and storage to what's necessary.