ASD ISM 2020Ensure Adequate Cyber Security Personnel Are Acquired
Official control statement
The CISO ensures sufficient cyber security personnel, with the right skills and experience, are acquired to support cyber security activities within their organisation.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
The CISO must recruit qualified cyber security staff to support the organisation's activities.
What this means in practice
This control is about making sure there are enough people with the right skills to protect your organisation's computer systems and data. Without enough cyber security staff, your organisation might be vulnerable to attacks, putting sensitive information at risk and potentially harming your reputation or operations.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Guideline
Guidelines for cyber security rolesTopic
Overseeing cyber security personnel
Why it matters
Insufficient cyber security staff can delay monitoring and incident response, weaken controls, and increase the likelihood of successful attacks and outages.
Operational notes
Review cyber security headcount and skills quarterly against workload and threat changes; address gaps via hiring, uplift training, or specialist support.
Implementation tips
- Management should identify the skills and number of cyber security employees needed for their organisation. This involves consulting with team leads and reviewing current security tools and systems to determine gaps or needs.
- HR should develop job descriptions for the necessary cyber security roles. These should be based on identified skills and responsibilities, and align with industry standards and the organisation's strategic goals.
- The CISO should coordinate with recruitment teams to actively source and attract qualified candidates. This could involve attending industry events, using specialised job boards, or partnering with universities offering cyber security programs.
- The IT team should establish an onboarding and ongoing training program for new recruits. This includes an introduction to the organisation's systems, security policies, and regular upskilling opportunities to keep staff updated with the latest cyber security threats and tools.
- Management should review the cyber security staffing plan annually to ensure it meets current and future needs. This involves conducting interviews with current staff and assessing any new threats or technologies impacting security needs.
Audit / evidence tips
- AskThe cyber security staffing plan: Request a document that outlines current staff levels and future hiring needsLook atThe rationale given for these staffing numbersGoodIncludes clear links between identified security needs and staffing plans
- AskJob descriptions and qualifications: Review the roles and required qualifications for cyber security positionsLook atAlignment with industry standards and the organisation's specific security needsGoodShows that job descriptions accurately reflect necessary skills and responsibilities
- AskRecruitment and hiring records: Request data on recent hiring activities for cyber security rolesLook atThe timelines and sources used to fill these rolesGoodShows a proactive approach to recruiting qualified candidates
- AskTraining and development programs: Request details of cyber security training provided to staffLook atThe frequency and content of training sessionsGoodIncludes relevant and regular training content that addresses current and emerging threats
- AskAnnual reviews of cyber staffing needs: Request reports or minutes from meetings where staffing needs were discussedLook atHow changes in technology and threat landscapes are factored into staffing plansGoodReflects consideration of both current needs and future challenges
Cross-framework mappings
How ISM-2020 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
handshakeSupports(1)expand_less | ||
| Annex A 5.2 | ISM-2020 requires the CISO to acquire sufficient cyber security personnel with the right skills and experience | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Cyber security roles
See all Guidelines for cyber security roles controls, or browse the full ASD ISM library.