ASD ISM 2003 Monitor cyber security workforce and skill gaps
What it says
The board of directors or executive committee maintains awareness of key cyber security recruitment activities, retention rates for cyber security personnel, and cyber security skills and experience gaps within their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishExecutives should stay informed on hiring and skills gaps in their cyber security team.
This control is about making sure that the people at the top of an organisation, like the board of directors, are aware of what's happening with the cyber security team. They need to know if there are enough qualified people, if those people have the right skills, and if they are staying with the company. If the leaders aren't paying attention, the organisation might not have the right people to protect it from cyber threats, leading to potential data breaches or financial loss.
Free. Save your status, tasks and notes.
Why it matters
Without executive oversight of cyber security recruitment, retention and skill gaps, key roles may remain unfilled and capability erodes, increasing breach likelihood and business impact.
How to implement
HR personnel should regularly review job descriptions and compare them with the current skill sets of the cyber security team.
This means looking at what skills are needed versus what the team members currently have and identifying any gaps. Use feedback from team managers to adjust job requirements and provide training recommendations.
The IT manager should set up quarterly meetings with the board to present a report on cyber security staffing.
Prepare a simple presentation that outlines key metrics like the number of open positions, time taken to fill roles, and retention rates, highlighting any ongoing challenges and successes in recruitment.
Team leaders in cyber security should conduct skill assessments of their team members every six months.
Use these assessments to map out which skills are present and which are lacking in the team. This information can then inform training plans or identify where new hires are needed.
Executives should promote a culture of continuous learning by encouraging team members to attend external training and certification courses.
Work with HR to establish a professional development plan that includes budget and time off for staff training.
The board of directors should support conducting an annual review of the cyber security workforce's effectiveness.
Engage an external consultant to evaluate whether the team structure is aligned with the latest cyber security threats and make recommendations for improvements.
Keep it running
Provide quarterly board/executive reporting on cyber recruitment pipelines, retention metrics and skills-gap analysis, with actions, owners and dates to close capability shortfalls.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The cyber security staffing report: Request the latest report presented to the board about hiring activities and workforce status.
Look at
The data on vacancies, recruitment timelines, and retention rates.
Good evidence
Includes up-to-date statistics and clearly articulated challenges and solutions discussed by the board.
- Check 2 of 5What an auditor asks for
Ask for
Skill assessment records: Request records of the skill assessments for the cyber security team.
Look at
The thoroughness of these assessments to ensure they reflect both strengths and skills gaps.
Good evidence
Shows that these assessments are completed regularly and contain actionable insights.
- Check 3 of 5What an auditor asks for
Ask for
Meeting minutes: Request minutes from meetings where cyber security staffing was discussed.
Look at
The discussion topics and any actions taken following these meetings.
Good evidence
Shows clear documentation of decisions and follow-up actions regarding staffing and skill gaps.
- Check 4 of 5What an auditor asks for
Ask for
Training and development plans: Request copies of professional development plans for the cyber security team.
Look at
The alignment of training initiatives with identified skills gaps.
Good evidence
Shows a strategic approach to developing workforce skills, including timelines and outcomes.
- Check 5 of 5What an auditor asks for
Ask for
Consultant reports: Request any external consultant evaluations of the cyber security team's structure and effectiveness.
Look at
Recommendations and how they were addressed.
Good evidence
Provides evidence of how external advice was incorporated into workforce planning.
Mappings
Closest match in ASD Essentials for enterprise IT: IT.GOV-04.2, Periodically review cyber security resourcing against threat trends, incidents and organisational change, which partially overlaps with this control.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-04.2Periodically review cyber security resourcing against threat trends, incidents and organisational changePartially overlaps
This control partially overlaps IT.GOV-04.2.
IT.GOV-04.2 requires periodic review of cyber security resourcing against threat trends, incident outcomes and organisational changes; ISM-2003 supports this, with the board or executive committee staying aware of cyber security recruitment, retention rates and skills gaps.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.