Cyber security roles

search account_circle

policyASD ISM

Guidelines for cyber security roles

42 controls in this part of theAustralian Government Information Security Manual. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Board of directors and executive committee

Define Cyber Security Roles for Leadership

The board sets specific cyber security roles and duties for themselves and the whole organisation.

Integrate Cyber Security Across Business Functions

Leaders ensure cyber security is a part of every business area.

Align Cyber Security with Business Strategy

Leadership ensures cyber security strategy aligns with the company's overall business direction.

Regular Cyber Security Briefings for Executives

Executives receive regular updates on cyber security and threats from experts.

Championing Cyber Security at an Executive Level

Executives set a good example to promote a healthy cyber security culture in the organisation.

Ensure Board Cyber Security Literacy for Compliance

Executive leaders must understand cyber security to meet legal and regulatory responsibilities.

Monitor Cyber Security Workforce and Skill Gaps

Executives should stay informed on hiring and skills gaps in their cyber security team.

Enhancing Cyber Security Skills and Experience

The board supports cyber security training for all staff using internal and external opportunities.

Board of Directors and Executive Committee

Understanding Business Criticality of Organisation Systems

Leaders need to know the importance, location, and protection of critical business systems.

Board Plans for Major Cyber Security Incidents

The board prepares for major cyber attacks by joining practice drills and knowing their responsibili

Chief information security officer

CISO Oversight of Cyber Security Personnel

The CISO is in charge of managing the organisation's cyber security staff.

CISO Reporting to Board on Cyber Security

The CISO must regularly update the board or executive committee on cyber security issues.

Develop and Maintain a Cyber Security Communication Strategy

The CISO creates and updates a strategy to share the organisation's cyber security goals effectively

Implement Cyber Security Metrics and KPIs

The CISO sets up metrics and indicators to measure and track cyber security performance in the organ

Coordinate Security Risk Management Activities

The CISO ensures business and security teams work together effectively on managing security risks.

CISO Oversight of Cyber Supply Chain Risks

The CISO is responsible for managing risks in their organisation's cyber supply chain.

Manage and Allocate Cyber Security Budget

The CISO is responsible for handling the organisation's dedicated cyber security funds.

Ensure CISO Awareness of Cyber Incidents

The CISO should be informed about all cyber security incidents in the organisation.

CISO Role in Disaster Recovery Planning

The CISO helps to ensure recovery plans are in place to maintain essential services during a disaste

Secure Facilities for Classified Systems

Classified systems are kept in secure locations fitting their classification level.

CISO Management of Cyber Security Compliance

The CISO is responsible for managing the organisation's cyber security and ensuring compliance with

Regular Review of Cyber Security Program

The CISO ensures the cyber security program stays relevant to combat threats and seize opportunities

CISO's Role in Cyber Security Incident Response

The CISO is responsible for managing the organisation's reactions to cyber security threats.

Regular Cyber Security Reporting to Audit Committee

The CISO reports cyber security updates directly to the organisation's risk committee.

Ensure Adequate Cyber Security Personnel Are Acquired

The CISO must recruit qualified cyber security staff to support the organisation's activities.

Chief Information Security Officer

Appoint a CISO to Lead Cyber Security Across IT and OT

The organisation must appoint a Chief Information Security Officer (CISO) who provides cyber securit

Cyber Security Steering Committee Coordination

The CISO aligns cyber security with business by regularly meeting with a dedicated committee of key

CISO Manages and Verifies System Register

The CISO keeps and checks a list of all the systems the organisation uses.

System owners

Identify Supplementary Controls for System Security

System owners consult officers to add extra security controls based on system specifics and organisa

Mandatory Authorisation for System Operation

System owners must get permission from an authorising officer to operate certain systems.

Assign System Ownership for Better Oversight

Every system should have a specific person responsible for managing it.

Risk Assessment for System Security

System owners work with authorising officers to assess threats and risks for each system.

Register Systems with Authorising Officers

System owners must register their systems with the designated authorising officer for oversight.

Determine System Boundaries and Objectives

System owners work with officers to set system boundaries and objectives based on potential impact i

Annual Security Status Reporting for Systems

System owners must annually report each system's security status to an authorising officer.

Implement Emanation Security Mitigation Recommendations

System owners, in consultation with each system's authorising officer, determine the system boundary

Tailoring System Controls for Security and Resilience

System owners, in consultation with each system's authorising officer, select controls for each syst

Ensure Security Controls for System Environments

System owners must apply security measures to safeguard each system and its environment.

Security Assessment for System Controls

System owners ensure security checks for specific systems to verify proper setup and operation.

Ensure Security Assessment of TOP SECRET Systems

System owners and officers ensure TOP SECRET systems are correctly assessed for security measures.

Obtain Authorisation for TOP SECRET Systems

System owners must get official approval to operate TOP SECRET systems from the Director-General ASD

Implement and Maintain Data Minimisation Practices

System owners should limit data collection and storage to what's necessary.

Back to the full Information Security Manual (ISM) control list, or browse the complete control library.