GOV-01 · Govern

Executive cyber security accountability

The board of directors or executive committee is accountable for cyber security.

Enterprise IT actions

• IT.GOV-01.1

  Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.

  • Every phaseGovernance and culture
  ASD’s indicators

  Not effective

  • No named executive or board member is accountable for cyber security.
  • Cyber security accountability exists only informally, or is assumed rather than documented.
  • No evidence of cyber security reporting to the executive board.
  • Organisational risk appetite is not set.

  Partially effective

  • A named executive or board member is accountable for cyber security, but reporting obligations are not formally defined.
  • Board-level reporting on cyber security occurs but is ad hoc rather than on a defined schedule.
  • Accountability is documented but has not been reviewed within the organisationally defined cadence or following relevant organisational restructuring or leadership changes.
  • Organisational risk appetite is set but is not monitored or adjusted over time.

  Fully effective

  • A named executive or board member has documented accountability for cyber security with defined reporting obligations.
  • Regular reporting to the board or executives occurs on a defined cadence with evidence of reporting artefacts.
  • Accountability arrangements are reviewed when organisational structures or leadership changes occur.
  • Organisational risk appetite is set and is monitored and adjusted over time as required.
  Related frameworks

  ISM

  ISM-1997, ISM-1998, ISM-1999, ISM-2000, ISM-2005

  NIST CSF 2.0

  GV.OC-01, GV.RR-01, GV.RR-02, GV.RM-01, GV.RM-02

  NIST SP 800-171r3

  03.15.01, 03.11.01, 03.11.04

  AESCSF v2

  PROGRAM-2a, PROGRAM-2c, RISK-1e, RISK-1f, PROGRAM-1d

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Formally define and establish executive and board-level accountabilities for OT cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.

  • Every phaseGovernance and culture
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Formally define and establish executive and board-level accountabilities for cyber security, including setting, monitoring and adjusting organisational risk appetite, and review these accountabilities at a defined cadence.

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Govern principles

• GOV-03Security risk management assurance
• GOV-04Cyber security resourcing
• GOV-07Continuous cyber security improvement
• GOV-08Executive artificial intelligence accountability
• GOV-09Security risk management responsibilities
• GOV-10System exposure minimisation
• GOV-11Supplier cyber security assurance
• GOV-14Legacy system management

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.