ASD ISM 2022 Develop and maintain cyber security training register
What it says
A cyber security awareness training register is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishMaintain a record of all cyber security awareness training activities within an organisation.
This control is about keeping track of who in your organisation has been trained on cyber security awareness. It's important because if you don't know who's been trained, your staff might miss out on vital information, leading to mistakes that could harm your business, such as data breaches or loss of customer trust.
Free. Save your status, tasks and notes.
Why it matters
Without a cyber security training register, staff training gaps go untracked, increasing phishing success and accidental data disclosure.
How to implement
Business owners or managers should create a training schedule and registration list.
Identify who needs cyber security awareness training and set up a timetable. Use a simple spreadsheet to keep track of who attends the sessions and what topics are covered.
Office manager or HR should ensure new staff are added to the register.
Whenever new employees join, make it a part of the onboarding process to add them to the training schedule. This can be done using the same spreadsheet or software where you track ongoing training.
IT team should collaborate with managers to update training materials.
Regularly check with the Australian Cyber Security Centre (ACSC) for the latest threats and update your training sessions accordingly. This ensures that training is relevant and on point.
The compliance officer or equivalent should review and update the register quarterly.
Look over the register every three months to ensure it is accurate and up-to-date. This involves checking entries against employee records and upcoming training schedules.
The organisation's leadership should promote the importance of cyber security training.
Encourage staff to see cyber security as a shared responsibility by regularly talking about why it matters and acknowledging those who actively participate in training.
Keep it running
Update the training register for new starters and completions; track overdue training and run refreshers when threat guidance changes.
Evidence and audit
- Check 1 of 4What an auditor asks for
Ask for
The cyber security training register: Request access to the document or system where training attendance is recorded.
Look at
How comprehensive the data is, including names, dates, and topics covered. Good evidence includes clearly documented and up-to-date records for all employees.
- Check 2 of 4What an auditor asks for
Look at
The relevance of content and its alignment with current best practices. Good evidence shows materials cover key topics like password safety, phishing threats, and privacy policies.
- Check 3 of 4What an auditor asks for
Ask for
A sample communication about training: Request to see how upcoming training sessions are communicated to staff. Check that the communication is clear and reaches all intended participants. Good practice includes emails or notices sent to all staff with detailed session information.
Look at
The attendance records for a recent training. Ensure that a majority of staff attended and follow-up actions were made for absentees.
Good evidence
Would show at least 80% attendance with make-up sessions for those who missed.
- Check 4 of 4What an auditor asks for
Ask for
Evidence of regular review of the training register: Request any meeting notes or reports where the training register was discussed.
Look at
Action items for updating the register. Good evidence includes documented records showing the register was reviewed and updated at least quarterly.
Mappings
Closest match in ISO/IEC 27001: A.6.3, Information security awareness, education and training program, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.6.3.
ISM-2022 requires an organisation to develop, implement and maintain a cyber security awareness training register to record all awareness training activities. Annex A 6.3 requires the organisation to run an information security awareness, education and training program (including regular updates) for personnel and relevant interested parties. A training register is a supporting artefact/evidence mechanism within a broader training program, but Annex A 6.3 also covers content, coverage and delivery that ISM-2022 does not specify.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-14.2Regularly update and deliver security awareness training as threats and operations changePartially overlaps
This control partially overlaps IT.PRO-14.2.
IT.PRO-14.2 requires cyber security awareness training to be updated and provided regularly to reflect current threats and operational considerations; ISM-2022 requires an awareness training register to be developed, implemented and maintained, supporting that program.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.