Skip to content
Gateways
ASD ISMISM-0612

ASD ISM 0612 Training for gateway system administrators

What it says

System administrators for gateways are formally trained on the operation and management of gateways.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Gateway system admins must be formally trained to operate and manage the gateways effectively.

This control ensures that people responsible for managing gateway systems are properly trained. It's important because, without the right training, system administrators might not handle the gateways effectively, leading to security vulnerabilities that could let hackers exploit the systems.

Why it matters

Inadequately trained gateway admins increase the risk of configuration errors, leading to unintentional exposure of sensitive data and potential system compromise.

How to implement

  1. System administrators should attend formal training courses specifically focused on managing and maintaining gateway systems.

    They can enrol in workshops or courses provided by recognised organisations like the ACSC (Australian Cyber Security Centre) to ensure they get up-to-date knowledge.

  2. Managers should organise regular refresher training sessions for system administrators.

    This can be done annually or biannually, using online courses or in-house training sessions, to keep everyone informed of any new developments in gateway technology.

  3. Supervisors should create a skills assessment checklist for all gateway system administrators.

    By evaluating current skills and knowledge against the needs of the system, they can identify gaps and arrange targeted training sessions.

  4. HR departments should maintain records of all gateway training sessions attended by system administrators.

    This includes details about the provider, date, and content of the training to ensure compliance and readiness.

  5. IT teams should facilitate group learning sessions where system administrators can share experiences and strategies for managing gateways.

    Encourage administrators to discuss challenges and solutions, fostering peer-to-peer learning and collaboration.

Keep it running

Maintain formal gateway admin training with refresher cycles; include rule changes, logging/monitoring, patching, and secure configuration of gateway features.

Evidence and audit

  1. Check 1 of 3What an auditor asks for

    Ask for

    The training records of each gateway system administrator.

    Look at

    The training certificates and dates to ensure they are up-to-date and relevant to gateway management.

    Good evidence

    Includes certificates from reputable training providers and recent completion dates.

  2. Check 2 of 3What an auditor asks for

    Good evidence

    List shows regular and diverse training relevant to the specific gateway systems in use.

  3. Check 3 of 3What an auditor asks for

    Ask for

    Feedback collected from system administrators about their training sessions. Evaluate any reported gaps or suggestions for further training. Positive feedback and actionable improvements suggest effective training programs.

Mappings

Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.6.3Information security awareness, education and training programPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.