GOV-03 · Govern

Security risk management assurance

Security risk management activities for an organisation and their systems (infrastructure, operating systems, applications and data) are embedded into organisational risk management frameworks and subject to ongoing monitoring and assurance activities by the board of directors or executive committee.

Enterprise IT actions

• IT.GOV-03.1

  Establish and maintain an approved risk management methodology and plan that is used to assess and treat cyber security risks.

  • Every phaseGovernance and culture
  ASD’s indicators

  Not effective

  • No risk management methodology approved by the organisation is in place.
  • No current organisational risk register exists, or the register has not been reviewed within the cycle defined by the organisation.
  • Risk treatment decisions are not documented.

  Partially effective

  • An approved risk management methodology exists but risk assessments have not been conducted within the defined cycle.
  • A risk register exists but treatment plans are incomplete or have not been actioned.
  • Risk assessments have been conducted but do not cover all in-scope assets.

  Fully effective

  • An approved risk management methodology and plan are in place and used to assess and treat security risks.
  • A current risk register exists with documented and implemented treatment plans for all identified risks.
  • Risk assessments have been conducted or reviewed within the assessment cycle defined by the organisation.
  Related frameworks

  ISM

  ISM-0009, ISM-1203, ISM-1526, ISM-1634

  NIST CSF 2.0

  GV.RM-01, GV.RM-02, GV.RM-03, GV.RM-06, GV.RM-07

  NIST SP 800-171r3

  03.11.01, 03.11.04, 03.15.01, 03.12.02

  AESCSF v2

  RISK-1a, RISK-1b, RISK-2b, RISK-2e

  Rate this action in the Navigator →

Cloud actions

• Action 1

  Establish and maintain an approved risk management methodology and plan that is used to assess and treat cyber security and shared responsibility risks

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Govern principles

• GOV-01Executive cyber security accountability
• GOV-04Cyber security resourcing
• GOV-07Continuous cyber security improvement
• GOV-08Executive artificial intelligence accountability
• GOV-09Security risk management responsibilities
• GOV-10System exposure minimisation
• GOV-11Supplier cyber security assurance
• GOV-14Legacy system management

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.