Search

Categories

System Hardening Cryptography gateways Networking System Management Communications Infrastructure Personnel Security Media software development Enterprise Mobility Communications Systems Procurement and Outsourcing cybersecurity roles Email Information Technology Equipment system monitoring Database Systems Physical Security Cyber Security Incidents Data Transfers

9 controls

Cyber Security Roles

ISM-0027

System owners obtain authorisation to operate each non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET system from its authorising officer based on the acceptance of the security risks associated with its operation.

ISM-0731

The CISO oversees cyber supply chain risk management activities for their organisation.

ISM-0734

The CISO contributes to the development, implementation and maintenance of business continuity and disaster recovery plans for their organisation to ensure that business-critical services are supported appropriately in the event of a disaster.

ISM-1071

Each system has a designated system owner.

ISM-1525

System owners register each system with its authorising officer.

ISM-1587

System owners report the security status of each system to its authorising officer at least annually.

ISM-1635

System owners implement controls for each system and its operating environment.

ISM-1966

The CISO develops, implements, maintains and verifies on a regular basis a register of systems used by their organisation.

ISM-1968

System owners obtain authorisation to operate each TOP SECRET system, including each sensitive compartmented information system, from Director-General ASD (or their delegate) based on the acceptance of the security risks associated with its operation.

Last updated May 21, 2025

The Information Security Manual and its controls are written by the Australian Cyber Security Centre.
Built with Hugo. Theme Stack designed by Jimmy