PRO-14 · Protect

Cyber security awareness training

Personnel are provided with ongoing cyber security awareness training, including operational security considerations, tailored to their duties, access levels and current cyber threats.

Enterprise IT actions

• IT.PRO-14.1

  Ensure all personnel receive cyber security awareness training, that is tailored to how they will interact with systems, applications and data in their assigned roles, before being granted access to organisational systems and data.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  ASD’s indicators

  Not effective

  • No requirement exists for personnel to complete cyber security awareness training before being granted access to critical, privileged or business systems.
  • No training completion records are maintained.

  Partially effective

  • A training program exists but is not tailored to the specific risks of the systems in-scope.
  • A requirement to complete training before access is granted exists but is not consistently enforced.
  • Completion records are maintained but show significant gaps in coverage.

  Fully effective

  • Role-tailored training programs address the specific risks, data handling obligations and incident reporting requirements relevant to in-scope systems.
  • All personnel complete role-tailored training before being granted access to organisational systems and data, with refresher training mandated within a cycle defined by the organisation.
  • Completion records are maintained and demonstrate full coverage.
  Related frameworks

  ISM

  ISM-0252, ISM-0435, ISM-1565, ISM-1865

  NIST CSF 2.0

  PR.AT-01, PR.AT-02, GV.RR-04

  NIST SP 800-171r3

  03.02.01, 03.02.02, 03.15.03

  AESCSF v2

  WORKFORCE-2a, WORKFORCE-2e, WORKFORCE-4d

  MITRE ATT&CK

  T1566 Phishing, T1078 Valid Accounts

  Rate this action in the Navigator →
• IT.PRO-14.2

  Update and provide cyber security awareness training on a regular basis to reflect current threats and operational considerations.

  • Every phaseGovernance and culture
  ASD’s indicators

  Not effective

  • No cyber security awareness training program exists.
  • Cyber security awareness training is not reviewed or updated after initial deployment.
  • Lessons learnt from cyber security incidents are not incorporated into training content.
  • The cadence of review is not defined.

  Partially effective

  • Training is reviewed but updates do not reflect current threat intelligence, sector relevant adversary techniques or organisational changes.
  • Some lessons are incorporated but the process is informal, or coverage is limited to a small number of incidents.
  • Some changes are reflected, but training is not updated to address recently introduced systems or significant changes to working arrangements.
  • A review cadence exists, but is not consistently met, or is not proportionate to the rate of change.

  Fully effective

  • Training content is reviewed and updated on a defined cycle, with updates reflecting current threat intelligence, adversary techniques relevant to the workforce and organisation's operating context.
  • Lessons learnt from cyber security incidents within the organisation or its sector are systematically incorporated into training content.
  • Training reflects the systems, platforms and working arrangements that personnel currently interact with, including newly introduced platforms and changes to ways of working.
  • The cadence of review is defined, proportionate to the rate of change in the threat environment, and consistently met.
  Related frameworks

  ISM

  ISM-1565, ISM-2022

  NIST CSF 2.0

  PR.AT-01, GV.OC-03, ID.RA-02

  NIST SP 800-171r3

  03.02.01, 03.02.02

  AESCSF v2

  WORKFORCE-2d, WORKFORCE-2c, WORKFORCE-2g

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Ensure all personnel receive cyber security awareness training that is tailored to how they will interact with OT systems in their assigned roles, and update it on a regular basis to reflect current threats and operational considerations.

  • Every phaseGovernance and culture
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Update and provide cyber security awareness training on a regular basis to reflect current threats and operational considerations.

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 2

  Ensure all personnel receive cyber security awareness training, that is tailored to how they will interact with organisational systems in their assigned roles, before being granted access to organisational systems and data.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-04Secure configuration management
• PRO-05Secure administration
• PRO-06Vulnerability management
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-09Content filtering
• PRO-10Regular and proven backups
• PRO-12Least privilege access
• PRO-13Identity, credential and access management
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation
• PRO-20Remote access to operational technology

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.