ASD Essentials IT.PRO-14.1 Require Role-Tailored Cyber Security Awareness Training Before Granting Access
What it says
Ensure all personnel receive cyber security awareness training, that is tailored to how they will interact with systems, applications and data in their assigned roles, before being granted access to organisational systems and data.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishGives everyone cyber security training suited to their role before they get access to the organisation's systems and data.
Everyone learns cyber security basics, such as spotting scam emails, guarding passwords and reporting anything odd. Each person also learns the risks and data handling rules of their role's systems. For example, service desk staff learn to check a caller's identity before a password reset. To meet this, everyone, including contractors, finishes it before getting a login or new access. They redo it on a set schedule, with records of who has done it.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems (does not apply)
- User devices (does not apply)
Why it matters
People given access before the right training are more likely to fall for a scam email and hand over a password. Attackers can then sign in as them unnoticed. The damage is worst when that person has admin or critical access.
How to implement
The head of security and HR should state in the access policy that everyone, including contractors and supplier staff, finishes role training before getting access.
Set a fixed schedule for refresher training.
The security awareness lead should map each role to the systems, applications and data it uses.
Build a basic module for everyone, plus role modules on each system's risks, data handling rules and incident reporting.
Owners of internet-facing, sign-in, critical and admin systems should supply the role content.
For example, teach service desk staff to confirm a caller's identity before a password reset, and give administrators training on admin accounts.
The identity and access team should make recorded completion a condition for switching on accounts and approving new access.
This includes role changes and admin access, with no manual workarounds.
The training coordinator should keep a completion record for every person in a training system linked to their identity record.
Assign refreshers automatically within the set schedule, and escalate overdue ones to managers.
Keep it running
The identity team builds the training check into requests for new starters, role changes and admin access. Each request waits until the matching training is done. Build role training in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems. Regularly match training records against active accounts and chase overdue refreshers. Anyone without a record does the training or loses access until they do.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the approved policy requiring training before access, and which personnel types it covers.
Look at
Whether the rule exists, and whether it covers contractors and supplier staff or only employees.
Good evidence
A written rule blocks access until role training is done, and sets a refresher schedule.
- Check 2 of 5What an auditor asks for
Ask for
Request the map of roles to training, plus the service desk and administrator modules.
Look at
Whether these roles get only the general course, missing identity checks before resets or admin account rules.
Good evidence
Each role module covers its systems' risks, data handling rules and incident reporting steps.
- Check 3 of 5What an auditor asks for
Ask for
Request training and access dates for recent new starters, role changes, contractors and new admins.
Look at
Whether anyone got access before finishing their training, or the check was overridden.
Good evidence
Everyone sampled finished role training before their access was switched on or approved.
- Check 4 of 5What an auditor asks for
Ask for
Ask for completion records for all personnel, matched against active accounts.
Look at
Whether records exist, and whether groups such as contractors or administrators have no record.
Good evidence
Everyone with access has a completion record, and the match shows no gaps.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the set refresher schedule and the current list of people who are overdue.
Look at
Whether refreshers are compulsory, and whether overdue people keep access with no follow-up.
Good evidence
Refreshers are compulsory within the set schedule, and overdue people are chased until done.
ASD indicators of good practice (8)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1No requirement exists for personnel to complete cyber security awareness training before being granted access to critical, privileged or business systems.
- NE-2No training completion records are maintained.
Partially effective(3)
- PE-1A training program exists but is not tailored to the specific risks of the systems in-scope.
- PE-2A requirement to complete training before access is granted exists but is not consistently enforced.
- PE-3Completion records are maintained but show significant gaps in coverage.
Fully effective(3)
- FE-1Role-tailored training programs address the specific risks, data handling obligations and incident reporting requirements relevant to in-scope systems.
- FE-2All personnel complete role-tailored training before being granted access to organisational systems and data, with refresher training mandated within a cycle defined by the organisation.
- FE-3Completion records are maintained and demonstrate full coverage.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.6.3.
IT.PRO-14.1 requires all personnel to receive cyber security awareness training tailored to how they will use systems, applications and data in their roles before they are granted access. This directly implements the role-relevant awareness training required by Annex A 6.3, adding the condition that it is completed before access is given. Annex A 6.3 is broader, also covering education, regular updates on the organisation's policies and procedures, and relevant interested parties as well as personnel.
This control supports A.8.7.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before they are granted access to organisational systems and data. Annex A 8.7 explicitly requires malware protection to be supported by appropriate user awareness, which this training provides where it covers threats such as malicious attachments and links. Annex A 8.7 centres on technical malware protection, while IT.PRO-14.1 covers awareness across all cyber security topics relevant to each role.
ASD Information Security Manual: 4 mappings
This control partially overlaps ISM-0252.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before being granted access; ISM-0252 requires annual awareness training for all personnel on set topics such as authorised use and incident reporting, overlapping on that training.
This control partially overlaps ISM-0435.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before being granted access; ISM-0435 requires personnel to receive any necessary briefings before being granted access, a related pre-access step using briefings rather than training.
This control partially overlaps ISM-1565.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before being granted access; ISM-1565 requires annual tailored privileged user training for all personnel with privileged access, a narrower role-specific case of that tailoring.
This control partially overlaps ISM-1865.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before being granted access; ISM-1865 requires personnel to agree to abide by system usage policies before being granted access, a companion pre-access condition rather than training.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.