GOV-04 Govern

Cyber security resourcing

Suitable and sufficient personnel and resources are identified, acquired and maintained in support of cyber security activities.

Enterprise IT actions

IT.GOV-04.1

Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of security controls and define cyber security responsibilities within role descriptions.
- Every phaseGovernance and culture
ASD’s indicators

Not effective
- Cyber security functions are staffed on an ad hoc basis without reference to required skills or capacity.
- Critical cyber security roles are unfilled with no approved recruitment plan.
- No resourcing plan for cyber security personnel exists.
Partially effective
- Some critical roles are filled but identified skills gaps have no plan for remediation.
- While assigned personnel provide some capability, there are gaps in capacity, resources, or expertise that hinder the operation, monitoring, maintenance, and lifecycle management of controls.
- A resourcing plan exists but does not cover all required cyber security functions.
- Outstanding cyber security positions are being actively recruited, but capacity or skills gaps remain.
Fully effective
- Sufficient cyber security personnel are assigned to operate, monitor, maintain and manage the lifecycle of controls across the organisation.
- Skills gaps are identified and addressed through recruitment, training or contracted services.
- A resourcing plan identifies all required cyber security personnel, roles, skills, resources and capacity.
- Cyber security responsibilities are defined within applicable role descriptions.
Related frameworks

ISM
ISM-0717, ISM-0732, ISM-2004, ISM-2020
NIST CSF 2.0
GV.RR-02, GV.RR-03, GV.RR-04
NIST SP 800-171r3
03.02.02, 03.15.01
AESCSF v2
WORKFORCE-3a, WORKFORCE-3b, WORKFORCE-4b, PROGRAM-2e

Rate this action in the Navigator
IT.GOV-04.2

Periodically review cyber security resourcing against cyber threat trends, cyber security incident outcomes and organisational changes.
- Every phaseGovernance and culture
ASD’s indicators

Not effective
- No review of cyber security resourcing has been conducted.
- Resourcing has not been reassessed following significant organisational or threat landscape changes.
Partially effective
- A review has been conducted but did not reference current threat trends, cyber security incident outcomes, or organisational changes.
- Review outcomes have identified required adjustments, but those adjustments have not been made.
Fully effective
- A resourcing review has been completed within the review period defined by the organisation.
- The review references current threat trends, cyber security incident outcomes and organisational changes.
- Documented review outcomes include resourcing adjustments that are implemented within timeframes defined by the organisation, or formally risk accepted by an appropriate authority.
Related frameworks

ISM
ISM-0724, ISM-1617, ISM-2003, ISM-2020
NIST CSF 2.0
GV.RR-03, GV.OV-03, GV.OC-05
NIST SP 800-171r3
03.11.01, 03.12.03, 03.14.03
AESCSF v2
WORKFORCE-3e, WORKFORCE-4c, PROGRAM-2g, RISK-2g

Rate this action in the Navigator

Operational technology actions

Action 1

Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of controls across OT, and define cyber security responsibilities within role descriptions.
- Every phaseGovernance and culture
Rate this action in the Navigator

Cloud actions

Action 1

Assign sufficient cyber security personnel and resources with the required skills to operate, monitor, maintain and manage the lifecycle of controls across cloud services, and define cyber security responsibilities within role descriptions.
- Every phaseGovernance and culture
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator
Action 2

Periodically review cyber security resourcing against cyber threat trends, cyber security incident outcomes and organisational changes.
- Every phaseGovernance and culture
- ResponsibilityPaaS: Customer, SaaS: Customer
Rate this action in the Navigator

Open the Navigator

More Govern principles

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.