ASD Essentials IT.GOV-04.1 Assign Sufficient Skilled Personnel to Run Security Controls and Define Role Responsibilities
What it says
Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of security controls and define cyber security responsibilities within role descriptions.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAssigns enough skilled staff and resources to introduce, run, watch, maintain and retire security controls, and writes security duties into role descriptions.
Security controls are the safeguards that protect systems, such as firewalls, backups and login checks. Each one needs people to run it, watch it, maintain it and manage it from setup to retirement. To meet this, a resourcing plan lists the people, skills, capacity and resources every control needs, and people are assigned to each. Gaps are filled by hiring, training or outside providers. Each role's security duties are written into its role description.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Governance and culture: a capability domain, which ASD applies across all phases from the start.
Why it matters
With too few people or the wrong skills, controls are installed but not properly run, watched or maintained. They weaken, warning signs are missed and known weaknesses stay open. Without written duties, tasks fall between teams.
How to implement
The head of security should build a resourcing plan, such as a table listing every cyber security function (area of work) and control.
Show the roles, skills, capacity and resources each needs to run, watch, maintain and retire it.
Security team leads should assign named staff or contracted services to run, watch, maintain and retire every control.
Balance workloads so no control relies on whoever is free or on one overloaded person.
The head of security should manage a cyber security budget that pays for the tools, licences, vendor support and training the plan needs.
This lets assigned staff keep controls working.
The head of security and HR should compare skills and capacity with the plan, and give each gap an owner.
Close gaps by hiring, training or contracting, and give each vacant critical role an approved recruitment plan and temporary cover.
HR and hiring managers should write cyber security duties into every relevant role description.
Include roles outside the security team, such as a network engineer who maintains the firewall, and update them when duties change.
Keep it running
This action applies organisation-wide, in every priority phase, so set it up early. As each new control is rolled out, the head of security adds the people, skills, capacity and resources it needs to the plan. They also have the affected role descriptions updated. Keep one current record of who runs each control. Watch for strain, such as postponed maintenance, unread alerts or one person covering several critical roles.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the current cyber security resourcing plan and budget.
Look at
Whether a plan exists and covers every function, with skills, capacity and resources, not just job titles.
Good evidence
The plan covers every function's people, roles, skills, capacity and resources, and the budget funds them.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the record of who runs each control, and recent backlog or overdue task reports.
Look at
Whether controls have no owner or rely on whoever is free, shown by postponed maintenance or unread alerts.
Good evidence
Every control has skilled people assigned for its whole life, and backlogs show enough capacity.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the latest skills gap analysis and the actions raised from it.
Look at
Whether each gap has an owner and a plan to close it, or is known but left open.
Good evidence
Each skills gap has an owner and is closing through hiring, training or contracted services.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the list of critical cyber security roles and the status of any vacancy.
Look at
Whether vacant critical roles lack an approved recruitment plan or anyone covering them meanwhile.
Good evidence
Critical roles are filled, or each vacancy has an approved recruitment plan and temporary cover.
- Check 5 of 5What an auditor asks for
Ask for
Ask for sample role descriptions, for security roles and for other roles that run controls.
Look at
Whether each states its cyber security duties, and these match who actually runs each control.
Good evidence
Relevant role descriptions set out cyber security duties that match who runs each control.
ASD indicators of good practice (11)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1Cyber security functions are staffed on an ad hoc basis without reference to required skills or capacity.
- NE-2Critical cyber security roles are unfilled with no approved recruitment plan.
- NE-3No resourcing plan for cyber security personnel exists.
Partially effective(4)
- PE-1Some critical roles are filled but identified skills gaps have no plan for remediation.
- PE-2While assigned personnel provide some capability, there are gaps in capacity, resources, or expertise that hinder the operation, monitoring, maintenance, and lifecycle management of controls.
- PE-3A resourcing plan exists but does not cover all required cyber security functions.
- PE-4Outstanding cyber security positions are being actively recruited, but capacity or skills gaps remain.
Fully effective(4)
- FE-1Sufficient cyber security personnel are assigned to operate, monitor, maintain and manage the lifecycle of controls across the organisation.
- FE-2Skills gaps are identified and addressed through recruitment, training or contracted services.
- FE-3A resourcing plan identifies all required cyber security personnel, roles, skills, resources and capacity.
- FE-4Cyber security responsibilities are defined within applicable role descriptions.
Mappings
Closest match in ISO/IEC 27001: A.5.2, Defining Information Security Roles and Responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.2.
IT.GOV-04.1 requires the organisation to assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage security controls, and to define cyber security responsibilities within role descriptions. Defining those responsibilities and assigning people to them overlaps directly with ISO/IEC 27001 Annex A 5.2, which requires information security roles and responsibilities to be defined and allocated. IT.GOV-04.1 adds expectations about resourcing sufficiency and skills, while Annex A 5.2 extends to security responsibilities held by roles across the whole organisation.
ASD Information Security Manual: 4 mappings
This control partially overlaps ISM-0717.
IT.GOV-04.1 requires sufficient skilled cyber security personnel and resources to operate and maintain security controls, with responsibilities defined in role descriptions; ISM-0717 supports the staffing side, with the CISO overseeing the management of cyber security personnel.
This control partially overlaps ISM-0732.
IT.GOV-04.1 requires sufficient skilled cyber security personnel and resources to operate and maintain security controls; ISM-0732 supports the resourcing side, with the CISO receiving and managing a dedicated cyber security budget.
This control partially overlaps ISM-2004.
IT.GOV-04.1 requires sufficient skilled cyber security personnel and resources to operate and maintain security controls; ISM-2004 supports the skills part, with the board or executive committee backing awareness raising and training to build all personnel's cyber security skills.
This control partially overlaps ISM-2020.
IT.GOV-04.1 requires sufficient skilled cyber security personnel and resources to operate and maintain security controls; ISM-2020 closely overlaps on staffing, making the CISO ensure sufficient personnel with the right skills and experience are acquired.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.