Skip to content
PRO-14 Cyber security awareness training
ASD EssentialsIT.PRO-14.2

ASD Essentials IT.PRO-14.2 Regularly Update and Deliver Security Awareness Training as Threats and Operations Change

What it says

Update and provide cyber security awareness training on a regular basis to reflect current threats and operational considerations.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Keeps cyber security training up to date with current threats and how people work, and keeps everyone trained.

Training soon goes out of date, so the organisation reviews and updates it on a set schedule. Updates reflect current threats to its people and sector, lessons from incidents, and new systems or ways of working. For example, a new scam aimed at finance staff goes into the training. To meet this, reviews run on time and as often as change requires. Big changes bring an early update, and everyone gets the latest version.

Where this action applies

What's in each domain?

Governance and culture: a capability domain, which ASD applies across all phases from the start.

Why it matters

If training is never updated, people are not ready for the scams going around now or the risks of new systems. A message they should have reported can give an attacker a way in, and past mistakes happen again.

How to implement

  1. The head of security should appoint a training program owner, who sets a review schedule matched to how fast threats and the organisation change.

    The owner lists triggers for early updates and has the security oversight committee approve both.

  2. The threat intelligence lead should brief the program owner before each review on current threats to the sector, using advisories and suspicious messages staff report.

    The owner updates examples for groups such as finance staff, recording each input.

  3. The incident response lead should send the program owner every people-related lesson from post-incident reviews, such as a scam email nobody reported.

    The owner logs these and sector lessons, and records how each changed the training.

  4. Change, project and HR teams should tell the program owner about new systems, new ways of working and restructures.

    The training then covers how people work now, such as a new messaging app, and drops retired tools.

  5. The learning and development team should deliver each updated version on the set schedule and push short updates when a trigger occurs.

    Record who completed which version so managers can follow up.

Keep it running

Between reviews, the program owner logs new threat warnings, incident lessons and planned changes to systems and ways of working. Bring an update forward when one cannot wait. Report each review against the set schedule to the security oversight committee, and treat a missed or late review as an issue to fix. This action applies organisation-wide, in every priority phase, so set it up early.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    Ask for the review schedule and its reasoning, the early-update triggers and the dated review log.

    Look at

    Whether no schedule is set, it lags the pace of change, reviews ran late, or triggers were ignored.

    Good evidence

    The schedule suits the pace of change, reviews run on time, and triggers bring early updates.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Request the version history and the threat briefing behind the latest update.

    Look at

    Whether content is unchanged since launch, or no change traces back to a warning or a reported message.

    Good evidence

    Each change traces to a threat input, with examples aimed at groups such as finance staff.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Request recent post-incident reviews, sector incident reports and the lessons log.

    Look at

    Whether there is no lessons log, or people-related findings, such as an unreported scam message, never reached it.

    Good evidence

    Every people-related lesson, internal or sector, is logged with the change or decision it led to.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Ask what systems and ways of working changed since the last update, and compare the training.

    Look at

    Whether the training still covers retired tools or misses new platforms and ways of working.

    Good evidence

    The training matches the systems and ways of working people use today.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Request delivery and completion records for the current training version.

    Look at

    Whether a training program runs at all, and whether staff still complete an old version.

    Good evidence

    Staff regularly receive the latest version, and records show who completed it and when.

ASD indicators of good practice (12)

The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".

Not effective(4)

  • NE-1No cyber security awareness training program exists.
  • NE-2Cyber security awareness training is not reviewed or updated after initial deployment.
  • NE-3Lessons learnt from cyber security incidents are not incorporated into training content.
  • NE-4The cadence of review is not defined.

Partially effective(4)

  • PE-1Training is reviewed but updates do not reflect current threat intelligence, sector relevant adversary techniques or organisational changes.
  • PE-2Some lessons are incorporated but the process is informal, or coverage is limited to a small number of incidents.
  • PE-3Some changes are reflected, but training is not updated to address recently introduced systems or significant changes to working arrangements.
  • PE-4A review cadence exists, but is not consistently met, or is not proportionate to the rate of change.

Fully effective(4)

  • FE-1Training content is reviewed and updated on a defined cycle, with updates reflecting current threat intelligence, adversary techniques relevant to the workforce and organisation’s operating context.
  • FE-2Lessons learnt from cyber security incidents within the organisation or its sector are systematically incorporated into training content.
  • FE-3Training reflects the systems, platforms and working arrangements that personnel currently interact with, including newly introduced platforms and changes to ways of working.
  • FE-4The cadence of review is defined, proportionate to the rate of change in the threat environment, and consistently met.

Mappings

Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.6.3Information security awareness, education and training programPartially meets
  • A.8.7Protection against malwareSupports
ASD ISM

ASD Information Security Manual: 2 mappings

  • ISM-1565Annual Tailored Training for All Privileged Access HoldersPartially overlaps
  • ISM-2022Develop and Maintain Cyber Security Training RegisterPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.