ASD ISM 2004 Enhancing cyber security skills and experience
What it says
The board of directors or executive committee supports the development of cyber security skills and experience for all personnel via internal and external cyber security awareness raising and training opportunities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe board supports cyber security training for all staff using internal and external opportunities.
This control is about ensuring everyone in your organisation gets proper training on cyber security. It's important because if your staff aren't aware of the latest security threats and how to handle them, your organisation could be at risk of data breaches, financial losses, or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Without executive-backed cyber security training and awareness, staff are more likely to make avoidable errors, enabling breaches and data loss.
How to implement
The HR team should review current training programs to ensure they include cyber security awareness.
They can do this by auditing existing resources and reaching out to training providers specialised in cyber security.
Managers should schedule regular cyber security workshops for their teams.
They can engage internal experts or hire external consultants to teach staff about the latest threats and safe practices.
The IT team should set up an internal portal with cyber security resources.
This can include training videos, best practice guides, and a contact list for questions or reporting suspicious activity.
Executives should endorse cyber security training by leading by example.
They can participate in training sessions and promote their importance in company meetings and newsletters.
The procurement department should budget for external cyber security training opportunities.
This involves researching reputable training providers and allocating funds from the annual training budget.
Keep it running
Have executives sponsor role-based cyber security training and awareness, track completion, and fund external courses to build staff skills and experience.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Training materials: Request copies of the cyber security training content used in sessions.
Look at
Whether these materials are current and cover essential topics like phishing and data protection.
Good evidence
Is well-organised, up-to-date content with practical examples.
- Check 2 of 5What an auditor asks for
Ask for
Attendance records: Request lists of attendees for recent cyber security training events.
Look at
The names and roles to ensure broad participation across the organisation.
Good evidence
Shows regular and inclusive training involvement.
- Check 3 of 5What an auditor asks for
Ask for
Feedback forms: Request the feedback gathered after cyber security training sessions.
Look at
Common themes or areas noted for improvement.
Good evidence
Reveals high satisfaction ratings and action plans for addressing any issues noted.
- Check 4 of 5What an auditor asks for
Ask for
A training schedule: Request past and planned training schedules.
Look at
How frequently training is held and whether it's available to all staff.
Good evidence
Shows consistent and well-publicised training opportunities throughout the year.
- Check 5 of 5What an auditor asks for
Ask for
The training budget: Request the annual budget allocated to cyber security training.
Look at
The allocation of funds and the utilisation rate.
Good evidence
Indicates a dedicated and sufficient budget with a high usage percentage.
Mappings
Closest match in ISO/IEC 27001: A.5.4, Management responsibilities for information security, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.4.
ISM-2004 requires board/executive support for developing cyber security skills and experience via awareness and training opportunities. ISO/IEC 27001:2022 Annex A 5.4 requires management to ensure personnel apply information security in accordance with policies and procedures. ISM-2004 supports Annex A 5.4 by building the awareness and competence needed for staff to follow policies consistently, but it does not itself impose the managerial enforcement requirement.
This control depends on A.6.3.
Annex A 6.3 requires organisations to provide appropriate awareness, education and training with regular policy and procedure updates relevant to roles. ISM-2004 focuses on executive-level support for developing cyber security skills and experience through internal and external awareness and training opportunities.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-04.1Assign sufficient skilled personnel to run security controls and define role responsibilitiesPartially overlaps
This control partially overlaps IT.GOV-04.1.
IT.GOV-04.1 requires sufficient skilled cyber security personnel and resources to operate and maintain security controls; ISM-2004 supports the skills part, with the board or executive committee backing awareness raising and training to build all personnel's cyber security skills.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.