ASD ISM 0252 Annual cyber security awareness for personnel
What it says
Cyber security awareness training is undertaken annually by all personnel and covers: - the purpose of the cyber security awareness training - security appointments and contacts - authorised use of systems and their resources - protection of systems and their resources - reporting of cyber security incidents and suspected compromises of systems and their resources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAll staff receive yearly training on using and protecting systems, and reporting incidents.
Cyber security awareness training is like giving everyone in your organisation the knowledge they need to safely use and protect computers and data. It's important because if staff aren't aware of cyber threats and how to report them, your organisation could be at risk of data breaches, financial loss, or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without annual cyber security awareness training, personnel may misuse systems, miss incident reporting steps and contacts, and increase risk of compromise and data loss.
How to implement
HR should schedule annual training sessions: Ensure all staff are notified about mandatory cyber security awareness sessions.
Create a calendar invite with clear details on timing and location, and send reminders.
The IT team should develop the training content: Focus the training on why cyber security matters, how to use systems safely, and how to spot and report potential threats.
Use simple examples and relatable scenarios.
Managers should encourage attendance and participation: Explain to your team why this training is critical for protecting our organisation.
Offer incentives or recognition for those who contribute ideas and questions during the session.
Appoint a security contact person: Identify a dedicated person or team who staff can approach with questions or to report security issues.
Clearly communicate their contact details during the training.
Gather feedback and improve each year: After the training, survey the attendees to gather their input on how engaging and useful the content was.
Use this feedback to refine next year's training materials.
Keep it running
Deliver and track annual training for all personnel, covering purpose, contacts, authorised use, protection of resources, and how to report incidents and suspected compromises.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The training schedule: Request the calendar entries or communications sent out for the cyber security training.
Look at
The dates, attendance requirements, and any follow-up actions.
Good evidence
Schedule shows clear dates, mandatory attendance notes, and has reminders sent out.
- Check 2 of 5What an auditor asks for
Ask for
How the training content was delivered and what they learned.
Good evidence
Is the HR manager explains the process and a staff member can recall key learnings and understand their importance.
- Check 3 of 5What an auditor asks for
Look at
The slides or handouts used during the training session.
Good evidence
Set includes plain language explanations of risks, system use, protection strategies, and incident reporting.
- Check 4 of 5What an auditor asks for
Good evidence
Session uses interactive and relatable examples, with active participation from attendees.
- Check 5 of 5What an auditor asks for
Ask for
Any surveys or feedback forms given post-training.
Look at
How feedback was acted upon.
Good evidence
Shows areas for improvement identified and specific actions taken in response.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.6.3.
Annex A 6.3 requires personnel and relevant interested parties to receive appropriate information security awareness, education, and training with regular updates of security policies and procedures relevant to their job function. ISM-0252 directly relates by mandating annual cyber security awareness training for all personnel and specifying core content areas such as authorised use, protection expectations, and incident reporting. ISM-0252 is more prescriptive on minimum topics and a yearly cadence, while Annex A 6.3 also covers education/training beyond awareness and includes relevant interested parties and policy update obligations.
This control depends on A.6.8.
Annex A 6.8 requires the organisation to provide defined channels and mechanisms so people can promptly report security events and suspected weaknesses. ISM-0252 supports Annex A 6.8 by requiring annual awareness training that includes how to report cyber security incidents and suspected compromises, improving correct and timely use of reporting channels. ISM-0252 is training-focused and does not itself establish or govern the reporting mechanism.
ASD Essential Eight: 1 mapping
- E8-MF-ML2.10Report cyber security incidents to the Chief Information Security Officer promptlySupports
This control supports E8-MF-ML2.10.
E8-MF-ML2.10 requires prompt reporting of cyber security incidents to the CISO (or delegate). ISM-0252 requires annual awareness training that includes security contacts and reporting of incidents and suspected compromises, which equips personnel to recognise when and how to report. While E8-MF-ML2.10 is the reporting requirement, ISM-0252 is a prerequisite enabler to ensure staff can execute that reporting pathway consistently and quickly.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-14.1Require role-tailored cyber security awareness training before granting accessPartially overlaps
This control partially overlaps IT.PRO-14.1.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before being granted access; ISM-0252 requires annual awareness training for all personnel on set topics such as authorised use and incident reporting, overlapping on that training.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.