Australian Information Security Manual ISM-0027: Authorisation to operate from authorising officer

What else in your programme already covers this

This control maps to 9 controls across 4 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

New Zealand Information Security Manual (NZISM) · 5 controls

1.1.69.C.02 1.1.69.C.02 Recording residual risk from unimplemented recommended controls
19.1.16.C.01 19.1.16.C.01 Connected owners accept residual gateway risk
19.5.24.C.03 19.5.24.C.03 Accreditation Authority accepts VoIP and UC risks
2.3.27.C.02 2.3.27.C.02 Formal acceptance of cloud risks by executives
22.1.21.C.04 22.1.21.C.04 Executive and Accreditation Authority acceptance of cloud risks

Protective Security Policy Framework (PSPF) Release 2026 · 2 controls

0086 0086 Authorise each system to operate before it handles government information
0088 0088 Authorise at the highest classification the system will handle

Australia IRAP - Information Security Registered Assessors Program · 1 control

IRAP-OUT-2 Authority to Operate decision support

ISO 27002:2022 · 1 control

5.8 Information security in project management

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.