ISM-0110 Removed History 2008 The system manager and/or information owner should be responsible for determining the ICT security audit requirements of a system, consistent with the requirements of the ICTSP and SRMP.