ASD Essentials IT.GOV-04.2 Periodically Review Cyber Security Resourcing Against Threat Trends, Incidents and Organisational Change
What it says
Periodically review cyber security resourcing against cyber threat trends, cyber security incident outcomes and organisational changes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishChecks on a set cycle that security staff, skills, tools and funding still match threat trends, lessons from incidents and organisational changes.
On a set cycle, the organisation checks it has the right security staff, skills, tools and funding. The review looks at threat trends, what recent incidents showed and how the organisation has changed. To meet this, the review happens on time and covers all three. Each shortfall is fixed on time, or someone with authority formally accepts the risk. For example, a merger or new online service may mean the security team needs more people.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Governance and culture: a capability domain, which ASD applies across all phases from the start.
Why it matters
Resourcing that is never reviewed, or reviewed with no follow-through, falls out of step with real risks. Teams become overstretched and security slips. Shortfalls shown by past incidents remain, making a repeat or worse incident more likely.
How to implement
The head of security should own the resourcing review and set how often it runs, based on risk.
Define its scope (staff numbers, skills, vacancies, tools, services and funding) and the changes that trigger an early review.
The security lead, or whoever tracks cyber threats, should brief each review on threat trends in the sector, using sources such as ASD's annual cyber threat report.
Explain what each trend means for staffing and tools.
The incident response lead should summarise incidents since the last review, including any response slowed by a lack of staff, skills, tools or funds.
Record the decision on each lesson.
Business, HR and IT leaders should tell the head of security about changes that alter security demand, such as restructures, mergers, new services or outsourcing.
Each one is then assessed at the next review or sooner.
The head of security should report review outcomes to the executive or board, giving each change an owner and due date in an action tracker.
If a change misses its date, someone with authority must formally accept the risk.
Keep it running
The head of security usually leads this action. It applies organisation-wide, in every priority phase, and covers the people and money behind all cyber security work. Between reviews, keep a running note of threat trends, incident outcomes and organisational changes, so each review starts from current facts. Review early after any big change in the organisation or in threats. Track agreed changes at regular governance meetings so they do not quietly stall.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the latest resourcing review and the document that sets how often it runs.
Look at
Whether a review has been done at all, or is overdue or undated.
Good evidence
The latest review is dated and falls inside the organisation's own review period.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the threat trend material used in the latest review.
Look at
Whether the review links current threat trends to resourcing, or just restates staff numbers and budget.
Good evidence
The review cites current, relevant threat trends and shows how they change resourcing needs.
- Check 3 of 5What an auditor asks for
Ask for
Ask for incident reports from the period and the part of the review that discusses them.
Look at
Whether lessons about resourcing, such as delays from staff or skills shortages, appear in the review.
Good evidence
The review covers recent incident outcomes, or records that none occurred, and weighs each lesson.
- Check 4 of 5What an auditor asks for
Ask for
Ask which big changes, in the organisation or in threats, happened since the last review.
Look at
Whether resourcing was reassessed after each one, and whether the review considers organisational change at all.
Good evidence
Each big change is followed by a written reassessment of resourcing.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the review outcomes, the action tracker and any risk acceptance records.
Look at
Whether agreed changes have stalled or been quietly dropped.
Good evidence
Every change is made on time, or the risk is formally accepted by someone with authority.
ASD indicators of good practice (7)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1No review of cyber security resourcing has been conducted.
- NE-2Resourcing has not been reassessed following significant organisational or threat landscape changes.
Partially effective(2)
- PE-1A review has been conducted but did not reference current threat trends, cyber security incident outcomes, or organisational changes.
- PE-2Review outcomes have identified required adjustments, but those adjustments have not been made.
Fully effective(3)
- FE-1A resourcing review has been completed within the review period defined by the organisation.
- FE-2The review references current threat trends, cyber security incident outcomes and organisational changes.
- FE-3Documented review outcomes include resourcing adjustments that are implemented within timeframes defined by the organisation, or formally risk accepted by an appropriate authority.
Mappings
Closest match in ASD Information Security Manual: ISM-0724, Implement Cyber Security Metrics and KPIs, which partially overlaps with this control.
ASD Information Security Manual: 4 mappings
This control partially overlaps ISM-0724.
IT.GOV-04.2 requires periodic review of cyber security resourcing against threat trends, incident outcomes and organisational changes; ISM-0724 has the CISO implement cyber security metrics and key performance indicators, which can inform those reviews.
This control partially overlaps ISM-1617.
IT.GOV-04.2 requires periodic review of cyber security resourcing against threat trends, incident outcomes and organisational changes; ISM-1617 is a broader review, with the CISO regularly reviewing and updating the cyber security program to keep it relevant to cyber threats.
This control partially overlaps ISM-2003.
IT.GOV-04.2 requires periodic review of cyber security resourcing against threat trends, incident outcomes and organisational changes; ISM-2003 supports this, with the board or executive committee staying aware of cyber security recruitment, retention rates and skills gaps.
This control partially overlaps ISM-2020.
IT.GOV-04.2 requires periodic review of cyber security resourcing against threat trends, incident outcomes and organisational changes; ISM-2020 has the CISO ensure sufficient personnel with the right skills and experience are acquired, the staffing outcome those reviews check.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.