Essentials for cloud
GOV-04 Cyber security resourcing
Give cyber security enough skilled staff and resources to run the controls across your cloud services. Write cyber security duties into role descriptions. Review that resourcing from time to time against threat trends, incident outcomes and changes in the organisation.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Suitable and sufficient personnel and resources are identified, acquired and maintained in support of cyber security activities.
The two actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 2
Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of controls across cloud services, and define cyber security responsibilities within role descriptions.
In plain English: Assign enough skilled cyber security staff and resources to run, monitor, maintain and manage your cloud controls through their life. Put cyber security duties in role descriptions.
- Domains
- Governance and culture
- Who does it
- PaaSCustomer
- SaaSCustomer
Action 2 of 2
Periodically review cyber security resourcing against cyber threat trends, cyber security incident outcomes and organisational changes.
In plain English: Review your cyber security staff and resources at intervals. Check them against cyber threat trends, incident outcomes and changes in the organisation.
- Domains
- Governance and culture
- Who does it
- PaaSCustomer
- SaaSCustomer
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
Everything else on this page is written by Control Stack.