PRO-14 Cyber security awareness training

two actionsAlso in ASD Essentials for enterprise IT

Give all personnel cyber security awareness training before they get access to your systems and data. Shape it to how their role will use those systems. Then update and run the training regularly so it keeps up with current threats and operational considerations.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Personnel are provided with ongoing cyber security awareness training, including operational security considerations, tailored to their duties, access levels and current cyber threats.

ASD, Information Security Manual (ISM), Principle PRO-14

The two actions

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

C: Customer
S: Supplied
P: Provider-inherited

Action 1 of 2
Update and provide cyber security awareness training on a regular basis to reflect current threats and operational considerations.
In plain English: Regularly update and run your cyber security awareness training. Keep it in line with current threats and operational considerations.
Domains
Governance and culture
Who does it
PaaSCustomer
SaaSCustomer
Action 2 of 2
Ensure all personnel receive cyber security awareness training, that is tailored to how they will interact with organisational systems in their assigned roles, before being granted access to organisational systems and data.
In plain English: Give all personnel cyber security awareness training before they get access to systems and data. Tailor it to how they will use your systems in their role.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSCustomer
SaaSCustomer
MITRE ATT&CK
Phishing
Valid Accounts
User Execution