Tie controls to material risk
Prioritise key business services, critical information and the consequences of control failure.
Describe coverage and gaps
Map relevant ISM, PSPF or other obligations to actual deployed controls and evidence, with accountable control owners.
Report measures you can substantiate
Use exception age, privileged access review coverage, critical patch exposure, recovery-test status and open high-risk design decisions.
Make remediation governance visible
Every material gap needs a decision owner, due date, exception rationale, funding treatment and evidence of closure.
Distinguish readiness and accreditation
Technical architecture support, independent assessment and formal authorisation have distinct roles and authorities.
Primary sources
Further reading: ASD ISM September 2026 and NIST CSF 2.0.