ASD Essentials for Enterprise IT GOV-01: Executive cyber security accountability: define board and executive accountabilities, risk appetite and a review cadence

What does GOV-01 require?

Boards and executives carry a written, agreed accountability for cyber security that covers setting the organisation's risk appetite, watching performance against it and adjusting it, and those accountabilities are revisited on a set schedule.

Maintained by Gerard Blokdyk

Other controls in Capability domain: Governance and culture – ASD Essentials for Enterprise IT

GOV-03 Security risk management assurance: maintain a risk management methodology and plan
GOV-04 Cyber security resourcing: assign skilled personnel, define responsibilities in roles and review resourcing periodically
GOV-08 Executive accountability for artificial intelligence use, governance and risk
GOV-11 Supplier cyber security assurance: risk-assess suppliers proportionately, retain evidence and keep assurance current
GOV-14 Legacy system management: identify, assess and treat the risks of legacy and unsupported technologies until removed
PRO-14 Cyber security awareness training: role-tailored before access, updated regularly for current threats

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ASD Essentials for Enterprise IT controls