Every Australian organisation that touches government work eventually meets the Information Security Manual (ISM) - and one of the most common training-related findings is a programme that does not match what the manual actually requires. This guide maps the ISM's personnel security controls onto a working awareness programme: the annual baseline every staff member needs, the tailored layers for high-risk groups, the register an auditor will ask to see, and the platform work Cyber Aware takes off your hands.
TL;DR
- The ISM (Australian Signals Directorate, September 2026 edition) requires cyber security awareness training annually for all personnel, covering five specific points (control ISM-0252).
- Training content must be tailored to groups of personnel, and anyone with privileged access needs separate tailored privileged user training each year (ISM-1565).
- A cyber security awareness training register must be developed, implemented and maintained (ISM-2022).
- Banking-detail changes, account modifications and synthetic impersonation each carry their own training advice in the ISM - build them in deliberately.
- Map your people first, build the baseline second, add tailored modules third, and keep the register current as evidence.
Why this matters
The ISM is the Australian Signals Directorate's cyber security framework, and its personnel security guidelines are specific about training in a way most corporate policies are not. The controls do not ask for "security awareness" in the abstract - they name who must be trained, how often, what the content covers and what records must exist.
That specificity is good news. It means an alignment exercise has a definite end state: security awareness training that an assessor can tick against named controls, because the platform already tracks completion per learner and per course. And because the Essential Eight maps to the ISM - ASD publishes the Essential Eight together with an explicit maturity-model-to-ISM mapping - aligning the training programme serves both frameworks at once.
What the ISM actually requires
Three controls do the heavy lifting in the personnel security guidelines (Guidelines for personnel security, September 2026):
- ISM-0252 - annual awareness training for all personnel. The control lists exactly what the training covers: the purpose of the training, security appointments and contacts, authorised use of systems and their resources, protection of systems and their resources, and reporting of cyber security incidents and suspected compromises.
- ISM-1565 - tailored privileged user training, annually. Personnel with privileged access - the manual names application, system and network administrators - require training tailored to that access, on top of the general baseline.
- ISM-2022 - a training register. An organisation must develop, implement and maintain a cyber security awareness training register. A completion percentage in a slide deck is not a register; per-person records with dates are.
The principle behind them (PRO-14) says training should be ongoing and tailored to duties, access levels and current threats - which is why the ISM also expects content to differ between general personnel and classes of high-risk personnel.
Before you start
- Know which edition you are aligning to. The ISM updates continuously; the September 2026 edition is current at the time of writing, and several training controls were revised across 2025 and 2026.
- A learner inventory by risk group. General staff, finance, HR, executives, IT administrators, contractors - the ISM's tailoring expectation needs group names, not "everyone".
- The gotcha: auditors ask for the register first. A programme that trains well but cannot produce per-person, per-date records fails ISM-2022 on the spot. Set up reporting before adding content.
Step 1 - Map your people to ISM groups
- List every learner group: general personnel, finance and payroll, HR, executives, developers, system administrators, contractors.
- Mark which groups handle banking details, payment requests or user account administration - the ISM calls these out specifically.
- Assign each group an owner who answers for their completion in the register.
Expected result: a named mapping from ISM risk classes to learner groups, ready to become courses and reporting filters.
Step 2 - Build the annual baseline against ISM-0252
- Cover the five named points in the baseline: why the training exists, who the security contacts are, what authorised use means, how to protect systems and resources, and how to report incidents or suspected compromises.
- Deliver it annually to all personnel, with a due window rather than an open-ended deadline.
- Keep lessons short and scenario-based - the ISM does not mandate a format, and short lessons completed beat long lessons skipped.
Expected result: every person completes the baseline annually, and each completion record lands in the register automatically.
Step 3 - Add the tailored layers
The personnel guidelines carry specific, dated advice that translates directly into modules:
- Banking details and payment requests (ISM-1740). Personnel handling these must be advised what business email compromise is and how to manage and report it. The manual lists the warning signs: unexpected requests to change banking details, urgent payment demands, unusual payment requests from people in authority, and suspicious sender addresses.
- User account modifications (ISM-2071). Password resets, changed phone numbers or email addresses, temporarily disabled multi-factor authentication, re-enrolment in MFA - requests like these can be help desk attacks, and the staff who handle them need to know what social engineering looks like.
- Synthetic impersonation (ISM-2126, added September 2026). Because AI can convincingly fake executive voices and video, personnel should positively identify requestors using a pre-established authentication method or an independent trusted channel before actioning account, banking or financial changes. Voice or video alone is not verification.
- Privileged user training (ISM-1565). Administrators get a separate annual track built around the systems they control.
Expected result: high-risk groups hold modules matched to the controls they touch, with the general baseline underneath.
Step 4 - Stand up the register (ISM-2022)
- Make the training platform's per-learner record the register of record: who, which course, completed when.
- Filter the record by group so you can answer "show me finance's completion" without a spreadsheet detour.
- Review the register monthly, not at audit time - gaps are cheap to fix in week two and expensive in audit week.
Expected result: a current register you can hand over on request, with no manual compilation.
A second alignment: Essential Eight at the same time
Because the Essential Eight maps to the ISM, one programme can evidence both. The eight strategies are technical, but several lean on behaviour: phishing-resistant MFA is defeated by a user who hands over a code, and macro restrictions are undermined by users who enable them on request. Simulations that practise the report-a-phish reflex and record who clicked cover the behavioural side, and Cyber Aware's phishing simulations auto-enrol anyone who clicks into a remediation lesson the same day.
Troubleshooting
- The auditor asks for evidence by date. If completion dates live in a spreadsheet, move them into the platform record before the audit window opens.
- Groups drift as people change roles. Directory-sync enrolment keeps group membership current; a quarterly reconciliation catches the rest.
- Contractors miss the baseline. Give contractors their own enrolment trigger and due date, and record them in the register like anyone else.
- The privileged track never gets built. Start with the administrator group you already have and ISM-1565 as the course brief; expand from there.
What to do next
Once the controls are mapped, the remaining question is where the programme stands today. A structured gap assessment turns the alignment exercise into a framework-mapped evidence pack you can show an assessor or a board.
FAQ
How often does the ISM require security awareness training? Annually for all personnel (ISM-0252), with tailored privileged user training also undertaken annually (ISM-1565). The principle behind the controls (PRO-14) frames training as ongoing, so annual is the floor rather than the target.
Does the ISM tell you which training provider to use? No. The controls specify coverage, frequency, tailoring and record-keeping - any platform that tracks per-person completion and supports tailored content can evidence them.
What is a cyber security awareness training register? The per-person record ISM-2022 requires an organisation to develop, implement and maintain. In practice, the completion history inside a training platform, filterable by person and group.
Do administrators need different training under the ISM? Yes. ISM-1565 requires tailored privileged user training annually for personnel with privileged access, separate from the general baseline.
What is ISM-2126 about? Added in September 2026: personnel must positively identify requestors using a pre-established authentication method or independent trusted channel before actioning account, banking or financial changes - a direct response to AI voice and video impersonation.
One last thing
The three controls are dated for a reason: ISM-1565 was revised in September 2026 and ISM-2022 in December 2025. An alignment exercise built on an older print of the manual is already out of date - re-check the edition before you present it.