ASD ISM 2020 Ensure adequate cyber security personnel are acquired
What it says
The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cyber security activities within their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe CISO must recruit qualified cyber security staff to support the organisation's activities.
This control is about making sure there are enough people with the right skills to protect your organisation's computer systems and data. Without enough cyber security staff, your organisation might be vulnerable to attacks, putting sensitive information at risk and potentially harming your reputation or operations.
Free. Save your status, tasks and notes.
Why it matters
Insufficient cyber security staff can delay monitoring and incident response, weaken controls, and increase the likelihood of successful attacks and outages.
How to implement
Management should identify the skills and number of cyber security employees needed for their organisation.
This involves consulting with team leads and reviewing current security tools and systems to determine gaps or needs.
HR should develop job descriptions for the necessary cyber security roles.
These should be based on identified skills and responsibilities, and align with industry standards and the organisation's strategic goals.
The CISO should coordinate with recruitment teams to actively source and attract qualified candidates.
This could involve attending industry events, using specialised job boards, or partnering with universities offering cyber security programs.
The IT team should establish an onboarding and ongoing training program for new recruits.
This includes an introduction to the organisation's systems, security policies, and regular upskilling opportunities to keep staff updated with the latest cyber security threats and tools.
Management should review the cyber security staffing plan annually to ensure it meets current and future needs.
This involves conducting interviews with current staff and assessing any new threats or technologies impacting security needs.
Keep it running
Review cyber security headcount and skills quarterly against workload and threat changes; address gaps via hiring, uplift training, or specialist support.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The cyber security staffing plan: Request a document that outlines current staff levels and future hiring needs.
Look at
The rationale given for these staffing numbers.
Good evidence
Includes clear links between identified security needs and staffing plans.
- Check 2 of 5What an auditor asks for
Ask for
Job descriptions and qualifications: Review the roles and required qualifications for cyber security positions.
Look at
Alignment with industry standards and the organisation's specific security needs.
Good evidence
Shows that job descriptions accurately reflect necessary skills and responsibilities.
- Check 3 of 5What an auditor asks for
Ask for
Recruitment and hiring records: Request data on recent hiring activities for cyber security roles.
Look at
The timelines and sources used to fill these roles.
Good evidence
Shows a proactive approach to recruiting qualified candidates.
- Check 4 of 5What an auditor asks for
Ask for
Training and development programs: Request details of cyber security training provided to staff.
Look at
The frequency and content of training sessions.
Good evidence
Includes relevant and regular training content that addresses current and emerging threats.
- Check 5 of 5What an auditor asks for
Ask for
Annual reviews of cyber staffing needs: Request reports or minutes from meetings where staffing needs were discussed.
Look at
How changes in technology and threat landscapes are factored into staffing plans.
Good evidence
Reflects consideration of both current needs and future challenges.
Mappings
Closest match in ASD Essentials for enterprise IT: IT.GOV-04.1, Assign sufficient skilled personnel to run security controls and define role responsibilities, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control supports A.5.2.
ISM-2020 requires the CISO to acquire sufficient cyber security personnel with the right skills and experience. Annex A 5.2 is a prerequisite because defining and allocating information security roles and responsibilities is necessary to identify what cyber security positions are required and what skills/experience to hire for. ISM-2020 focuses on obtaining people, while Annex A 5.2 focuses on the organisational role design and allocation that drives recruitment needs.
ASD Essentials for enterprise IT: 2 mappings
- IT.GOV-04.1Assign sufficient skilled personnel to run security controls and define role responsibilitiesPartially overlaps
This control partially overlaps IT.GOV-04.1.
IT.GOV-04.1 requires sufficient skilled cyber security personnel and resources to operate and maintain security controls; ISM-2020 closely overlaps on staffing, making the CISO ensure sufficient personnel with the right skills and experience are acquired.
- IT.GOV-04.2Periodically review cyber security resourcing against threat trends, incidents and organisational changePartially overlaps
This control partially overlaps IT.GOV-04.2.
IT.GOV-04.2 requires periodic review of cyber security resourcing against threat trends, incident outcomes and organisational changes; ISM-2020 has the CISO ensure sufficient personnel with the right skills and experience are acquired, the staffing outcome those reviews check.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.