ASD Essentials Governance and Culture

ASD describes Governance and culture as Policies, risk management processes, roles and security culture that underpin cyber security program. The risk it addresses is that unclear accountability leads to inconsistent security decisions and to controls that weaken over time.

Where the technical domains deal with systems, Governance and culture deals with organisational arrangements and the records that show how they operate. ASD’s implementation planning guide gives cyber security strategies, policies and procedures, awareness and training programs, security roadmaps and risk registers as examples.

The principles come primarily from the Govern family of ASD’s Information Security Manual (ISM), with one Protect principle covering awareness training.

A written policy alone does not prove effectiveness. The organisation has to show who holds authority, which risks were accepted or assigned for treatment, what was decided and whether the decisions led to action.

Governance starts alongside the first technical priority phase and runs for the whole implementation. ASD’s implementation planning guide places it in the first example project tranche, which delivers the governance, detection and assessment capabilities every later phase depends on.

For a security lead, that means naming accountable owners and getting a working risk process and reliable reporting in place while the technical controls are being implemented. Governance records assembled only when an assessment begins cannot show how decisions were made during the period it covers.

GOV-01 places accountability for cyber security with the board and executives, formally and by name. Its action asks organisations to Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting risk appetite, with accountabilities reviewed at a defined cadence.

The security team can operate controls, investigate incidents and prepare risk recommendations. Oversight, risk appetite and the decisions within their authority stay with the board and the accountable executives.

The documented arrangement names the accountable people, their reporting obligations, the decisions they can make and the route by which an unresolved risk reaches the appropriate authority.

ASD’s Indicators of Good Practice distinguish between:

The arrangement also needs review after relevant leadership or organisational changes. A governance document that still names a former executive does not tell anyone who owns a decision today.

Board reporting earns its place when it connects the security position to decisions the board can make. Directors need to follow material risks, changes in exposure, accepted exceptions, treatment progress and unresolved resource needs without having to interpret technical event data.

For example, a line reporting that an unsupported business system is still running helps the board only when it sits beside the risk, the approved controls, the responsible owner and the progress towards replacement.

A sequence of dated reports and meeting decisions is stronger evidence than a single presentation. The detailed approach to effectiveness ratings and assessment evidence is covered in ASD Essentials assessment and reporting.

GOV-04 asks whether the security function is resourced: enough skilled personnel and resources to operate, monitor, maintain and manage the organisation’s cyber security controls.

The first action asks organisations to Assign sufficient cyber security personnel and resources with the required skills and to document security responsibilities within applicable role descriptions.

A second action asks for periodic reviews against cyber threat trends, incident outcomes and organisational changes.

Establish Required Capabilities

A cyber security resourcing plan starts from the functions needed to sustain the controls in use. The number of employees assigned to the security team does not answer that question.

Those functions include implementation, ongoing operation, monitoring, maintenance and management throughout the security control lifecycle.

ASD’s Indicators of Good Practice recognise recruitment, training and contracted services as ways to address skills gaps. Not every specialist capability has to sit in-house. The organisation does have to show that the required work is covered.

For example, an external SOC may provide monitoring and investigation while internal personnel keep responsibility for risk decisions, access approvals and remediation. Both sides of that split need to be documented and understood by the people on each side of it.

Role descriptions need to match the actual division of work. A responsibility listed against a role that lacks the capacity or skills to perform it does not make the function adequately resourced.

Review Capacity and Skills

A resourcing review checks whether the existing people, skills and services are still sufficient as the threat environment and the organisation change.

GOV-04 ties these reviews to cyber threat trends, incident outcomes and organisational changes. A significant incident may expose a capability gap that was not apparent when the previous resourcing plan was approved.

A useful review records the deficiency, its operational consequence, the proposed adjustment and the decision made.

ASD’s fully effective indicators expect identified adjustments to be implemented within defined timeframes or formally risk accepted by an appropriate authority. A review that is completed while known deficiencies go unaddressed may leave the action partially effective.

ASD’s planning guidance also emphasises sustainment costs. Controls need funding and people after they are deployed, particularly where monitoring, maintenance and specialist support continue throughout their lifecycle.

GOV-11 asks organisations to assess the cyber security risk a supplier introduces before engaging it and then to maintain supplier security assurance for as long as the relationship lasts.

The principle covers suppliers of software, hardware and services. Relevant examples include providers with access to important systems, sensitive information or security operations.

Supplier assurance covers the original decision to engage a provider and, after it, the continuing evidence that the provider meets its commitments.

Assess Suppliers Before Onboarding

The first GOV-11 action asks organisations to select suppliers on the basis of a cyber supply chain risk assessment proportionate to the risk the supplier introduces.

In a proportionate assessment, the supplier’s criticality, its access and the potential consequences of its compromise are weighed first. The level of assurance is decided from there.

A provider that manages privileged accounts or holds security logs presents a different exposure from a supplier with no access to organisational systems, and the depth of assessment follows that difference.

The assessment record connects:

ASD’s Indicators of Good Practice expect supplier assessments to be proportionate to risk, supported by evidence and reflected in the decisions made before engagement.

Keep Assurance Current

The second GOV-11 action asks organisations to maintain assurance and act when that assurance lapses or the supplier’s risk changes.

An assessment completed at onboarding describes the supplier as it was on that date. It does not show that the supplier still meets its security commitments.

ASD’s Indicators of Good Practice look for defined acceptable evidence, with its scope and currency, and for documented responses to material concerns. Those responses may include contractual remediation, compensating controls or supplier substitution within defined timeframes.

For any supplier, the organisation needs to be able to say which evidence is acceptable, whether that evidence is still current and what happens when a concern is identified.

A practical assurance record connects the supplier to its assessment, current evidence, review outcome, identified concerns and follow-up decisions. An assurance report that has expired appears in that record as a gap requiring review. It no longer counts as current evidence.

ASD’s chapter selection guidance states that outsourcing a service does not transfer accountability. The point applies with most force where MSPs and SOC providers manage privileged access, hold security logs or perform response actions. ASD Essentials for MSPs covers the provider side.

AI suppliers raise further questions. ASD’s AI guidance asks organisations to find out where prompts and outputs are retained and whether organisational data is used to train models.

These questions belong in the supplier assurance process, alongside the governance review of the AI use case under GOV-08.

The evidence to collect for Governance and culture is a record of things that happened: decisions, reviews and treatments dated within the assessment period. Policies and registers describe the process. Dated records show whether it operated.

The collection methods are common practice rather than ASD requirements. The checks in the last column draw on ASD’s Indicators of Good Practice for each action.

A single board paper shows reporting at one point in time. A run of papers, minutes and decisions across the assessment period is better evidence that reporting follows its defined cadence.

Other governance records have the same weakness. A risk register may list treatment dates without showing that the treatments were completed. A supplier file may show an initial approval and nothing about whether the evidence is still current.

Dated exports from risk and supplier systems are generally a stronger record than isolated screenshots, particularly where they include the relevant status and history. A screenshot can support the record when the system and the date of capture are identifiable in it.

ASD’s assessment process guide asks whether evidence is recent enough to reflect the current implementation, so the records need to cover the period being assessed. Minutes and register entries all dated in the week before an assessment show when the record was made and little about the period itself.

Where evidence shows a gap, keep the finding and its treatment decision. A documented deficiency with an accountable owner and a follow-up action is a more useful record of governance than a register that conceals unresolved issues.

ThreatDefence runs a 24x7 SOC with its team based in Australia and a 3 min average response under guaranteed SLAs. Threat hunting and an incident response retainer are included in the standard service. Response actions stay within the authority each customer approves, and case records can be exported for an assessor or at the end of a contract. Australian customers’ data and AI processing stay in Australia. ThreatDefence does not certify organisations; the assessor determines ASD Essentials ratings.

ThreatDefence is also a supplier that organisations should assess under GOV-11. Its assurance includes ISO 27001 and PCI DSS certification and a SOC 2 report.

To see where you stand today, rate your environment action by action in the free ASD Essentials Navigator, with principle and domain results that update as you go. Readers new to the framework can start with the five-minute ASD Essentials explainer, which walks through principles, actions, domains, priority phases and ratings.

Open the ASD Essentials Navigator Start the 5-Minute Explainer Explore ASD Essentials Compliance