ASD ISM 1565 Annual tailored training for all privileged access holders
What it says
Tailored privileged user training is undertaken annually by all personnel with privileged access to systems and their resources.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEveryone holding privileged access to systems or their resources completes training built for that role every year, so elevated rights are used safely and knowingly.
Privileged access means an account or role that can do more than an ordinary user: change configurations, manage other accounts, read or alter data across a system, or reach the underlying resources a system depends on. This control says that every person who holds that kind of access must complete training each year, and that the training must be tailored to privileged use rather than the general cyber security awareness content given to all staff. It matters because the safeguards that stop an ordinary user from causing damage often do not apply to a privileged user. A single mistaken command, a misused credential or a poorly understood responsibility can affect an entire system. Training that speaks specifically to the risks, expectations and obligations of privileged access gives those people the knowledge to act carefully, and repeating it annually keeps that knowledge current as systems, threats and people change. The scope is deliberately broad: "all personnel" means employees, contractors and any other person who holds privileged access, and "systems and their resources" covers not just the system itself but the data, services and infrastructure it relies on.
Free. Save your status, tasks and notes.
Why it matters
Without tailored annual training, privileged users may not understand the specific risks and obligations that come with their elevated access. Errors made with privileged rights can disable security controls, expose or corrupt data, or take systems offline, and a privileged user who cannot recognise targeted attacks such as credential theft or social engineering is a high-value target for adversaries. Untrained or stale-trained privileged users therefore raise the likelihood and severity of both accidental damage and deliberate compromise, and leave the organisation unable to demonstrate that people with the most powerful access were prepared to use it responsibly.
How to implement
The security or identity team extracts a complete list of all personnel with privileged access to systems and their resources from directory services, privileged access management tools and application admin consoles, and uses it as the mandatory training roster.
The security awareness lead, working with system owners, develops training content specific to privileged use, covering the risks, responsibilities and expected practices for the systems and resources those users administer, rather than reusing general staff awareness material.
The training coordinator loads the tailored modules into the learning management system, assigns them to every account on the privileged roster including contractors and third parties, and sets a recurring annual due date for each person.
The access provisioning owner adds a step to the privileged access request and onboarding process that requires completion of the tailored training before or at the time privileged access is granted, so new privileged users enter the annual cycle immediately.
The security team runs a monthly reconciliation between the current privileged access list and training completion records, notifies managers of overdue personnel, and updates the training content each year to reflect changes in systems, threats and procedures.
Keep it running
Day to day, this control depends on knowing exactly who holds privileged access at any point in time, so the training population should be derived from the live list of privileged accounts and roles rather than from a static spreadsheet. When privileged access is granted to a new person, training completion should be part of the onboarding or access-approval step, and the annual due date should then be tracked from that first completion.
The training content needs to be genuinely tailored: it should reflect the systems and resources the audience actually administers, the privileged actions they perform and the organisation's expectations for how privileged access is used. Different privileged groups (for example system administrators, database administrators, network engineers and cloud platform operators) may need different modules. Contractors and third-party personnel with privileged access are in scope and must be captured in the same tracking.
Completion records should be kept in a form that can be reconciled against the privileged-user list, with overdue training flagged and escalated. Review the content at least annually so it stays relevant to current systems, threats and internal procedures.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the current list of all personnel with privileged access to systems and their resources, including contractors and third parties.
Look at
Compare the list against privileged group memberships in directory services, privileged access management tools and application admin roles to check it is complete and current.
Good evidence
A single authoritative list exists, matches the live privileged accounts and roles, and is refreshed as access changes.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the privileged user training materials and course outlines currently in use.
Look at
Check that the content addresses privileged-specific risks, responsibilities and practices for the systems and resources these users administer, and that it differs from general staff awareness training.
Good evidence
The material is clearly tailored to privileged access and reflects the organisation's actual systems, roles and expectations.
- Check 3 of 5What an auditor asks for
Ask for
Request training completion records for every person on the privileged access list for the last twelve months.
Look at
Reconcile completions against the roster and confirm each person completed the tailored training within the past year, with no unexplained gaps.
Good evidence
Every privileged user, including contractors and third parties, has a dated completion record within the annual window.
- Check 4 of 5What an auditor asks for
Ask for
Ask how the training cycle is scheduled and how new privileged users are brought into it.
Look at
Review the learning platform assignment rules and the privileged access onboarding or approval procedure to see whether training is triggered on grant and then recurs annually.
Good evidence
Annual assignments are automated or systematically tracked, and new privileged users complete the training when access is granted.
- Check 5 of 5What an auditor asks for
Ask for
Ask for evidence of how overdue training is identified and handled, and how the content is reviewed over time.
Look at
Look at reconciliation reports, escalation emails or tickets for overdue personnel, and version history or review notes for the training content.
Good evidence
Overdue cases are detected and escalated promptly, and the content shows dated reviews that keep it relevant to current systems and threats.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.6.3.
ISM-1565 requires annual, role-tailored training for all personnel holding privileged access so elevated rights are used safely. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide information security awareness, education and training program with content appropriate to job function and regular updates. ISM-1565 is a specific, privileged-user subset and cadence requirement within the broader training program scope of Annex A 6.3.
This control supports A.8.2.
ISM-1565 requires annual, tailored privileged user training so administrators and other privileged users understand secure and approved use of elevated access. ISO/IEC 27001:2022 Annex A 8.2 requires privileged access rights to be restricted and managed across their allocation and use. Training mandated by ISM-1565 supports Annex A 8.2 by ensuring privileged users understand processes such as least privilege, approval boundaries, and safe admin practices, but Annex A 8.2 is fundamentally an access-rights governance and control requirement rather than a training requirement.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-14.1Require role-tailored cyber security awareness training before granting accessPartially overlaps
This control partially overlaps IT.PRO-14.1.
IT.PRO-14.1 requires all personnel to receive role-tailored cyber security awareness training before being granted access; ISM-1565 requires annual tailored privileged user training for all personnel with privileged access, a narrower role-specific case of that tailoring.
- IT.PRO-14.2Regularly update and deliver security awareness training as threats and operations changePartially overlaps
This control partially overlaps IT.PRO-14.2.
IT.PRO-14.2 requires cyber security awareness training to be updated and provided regularly to reflect current threats and operational considerations; ISM-1565 requires annual tailored privileged user training for everyone with privileged access, a regular cycle for one group.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.