What does ASD ISM 2003 require?

policyASD Information Security Manual (ISM)

ASD ISM 2003Monitor Cyber Security Workforce and Skill Gaps

Official control statement

The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps within their organisation.

policyASD Information Security Manual (ISM)ISM-2003

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Executives should stay informed on hiring and skills gaps in their cyber security team.

NC OS PASD Information Security ManualGuidelines for cyber security roles

Control Stack classificationProactive Competence and skills Security governance and leadership Governance

record_voice_over

What this means in practice

This control is about making sure that the people at the top of an organisation, like the board of directors, are aware of what's happening with the cyber security team. They need to know if there are enough qualified people, if those people have the right skills, and if they are staying with the company. If the leaders aren't paying attention, the organisation might not have the right people to protect it from cyber threats, leading to potential data breaches or financial loss.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Proactive

Classifications

NC, OS, P, S, TS

ISM last updated

Dec 2025

Control Stack last updated

29 Sept 2026

E8 maturity levels

N/A

Guideline

Guidelines for cyber security roles

Section

Board of directors and executive committee

Topic

Building cyber security expertise

priority_high

Why it matters

Without executive oversight of cyber security recruitment, retention and skill gaps, key roles may remain unfilled and capability erodes, increasing breach likelihood and business impact.

settings

Operational notes

Provide quarterly board/executive reporting on cyber recruitment pipelines, retention metrics and skills-gap analysis, with actions, owners and dates to close capability shortfalls.

02 - Implement

build

Implementation tips

HR personnel should regularly review job descriptions and compare them with the current skill sets of the cyber security team. This means looking at what skills are needed versus what the team members currently have and identifying any gaps. Use feedback from team managers to adjust job requirements and provide training recommendations.
The IT manager should set up quarterly meetings with the board to present a report on cyber security staffing. Prepare a simple presentation that outlines key metrics like the number of open positions, time taken to fill roles, and retention rates, highlighting any ongoing challenges and successes in recruitment.
Team leaders in cyber security should conduct skill assessments of their team members every six months. Use these assessments to map out which skills are present and which are lacking in the team. This information can then inform training plans or identify where new hires are needed.
Executives should promote a culture of continuous learning by encouraging team members to attend external training and certification courses. Work with HR to establish a professional development plan that includes budget and time off for staff training.
The board of directors should support conducting an annual review of the cyber security workforce's effectiveness. Engage an external consultant to evaluate whether the team structure is aligned with the latest cyber security threats and make recommendations for improvements.

03 - Audit

fact_check

Audit / evidence tips

AskThe cyber security staffing report: Request the latest report presented to the board about hiring activities and workforce statusLook atThe data on vacancies, recruitment timelines, and retention ratesGoodIncludes up-to-date statistics and clearly articulated challenges and solutions discussed by the board
AskSkill assessment records: Request records of the skill assessments for the cyber security teamLook atThe thoroughness of these assessments to ensure they reflect both strengths and skills gapsGoodShows that these assessments are completed regularly and contain actionable insights
AskMeeting minutes: Request minutes from meetings where cyber security staffing was discussedLook atThe discussion topics and any actions taken following these meetingsGoodShows clear documentation of decisions and follow-up actions regarding staffing and skill gaps
AskTraining and development plans: Request copies of professional development plans for the cyber security teamLook atThe alignment of training initiatives with identified skills gapsGoodShows a strategic approach to developing workforce skills, including timelines and outcomes
AskConsultant reports: Request any external consultant evaluations of the cyber security team's structure and effectivenessLook atRecommendations and how they were addressedGoodProvides evidence of how external advice was incorporated into workforce planning