ISO 27001 clause 7.2: Competence and learning effectiveness
ISO 27001 clause 7.2 concerns the competence of people doing work under the organisation’s control that affects information security performance. The organisation determines the competence needed, ensures suitable capability and, where applicable, takes action to acquire it and evaluates that action’s effectiveness. Training attendance is one input, not the whole result.
What clause 7.2 requires in practice
Clause 7.2 asks the organisation to be deliberate about the capability of everyone whose work can affect information security performance. That includes employees, but also contractors and others working under its control. The requirement has four parts.
- Decide what competence each kind of work needs.
- Make sure the people doing that work meet it, judged by education, training or experience.
- Where there is a gap, act to close it, then check whether the action worked.
- Keep suitable records as proof of competence.
The accompanying note lists ways to close a gap: training, mentoring, moving people into different roles, or hiring or contracting someone already capable. The outputs are a clear picture of needed capability, development actions with a judgement of their results, and records that an auditor can sample. The clause does not name a course, a pass mark or a competence matrix; those are methods the organisation chooses.
Define competence by the work
Start with decisions and tasks rather than a list of course names. A risk owner needs to understand criteria, business consequences and acceptance authority. An administrator may need to operate access controls and recognise exceptions. A procurement owner needs to identify security requirements and know when specialist review is needed.
Education, training and experience can all contribute. A person can have considerable technical experience while being unfamiliar with the organisation’s approval process. Conversely, completing an awareness course does not by itself demonstrate competence to conduct a complex assessment or internal audit.
Choose and evaluate development actions
Compare required capability with evidence of current ability. Where action is needed, consider training, supervised practice, mentoring, reassignment or obtaining suitable specialist support. Select the action for the gap rather than giving every role the same course and assuming the problem is solved.
Evaluate effectiveness using an appropriate method. A practical task, reviewed assessment, observed response or work sample can show whether learning transfers to the job. The standard does not prescribe a universal examination or pass score. Avoid making a knowledge quiz the sole evaluation of a practical responsibility it does not test.
Retain appropriate documented information as competence evidence. This can combine qualifications, experience, learning records and evaluated work. Keep personal information proportionate and appropriately protected. A competence matrix is a useful organising tool, but its green cells should have a basis.
Why competence matters to the business
Most security failures trace back to someone doing a task without knowing how to do it safely: an administrator who misconfigures access, a risk owner who accepts exposure they do not understand, a buyer who signs a supplier contract with no security terms. Customers increasingly ask who handles their information and whether those people are prepared. Competence evidence also shapes the audit outcome, because auditors interview staff and compare what they say with what the records claim. Where a training certificate exists but the person cannot explain the task, the finding is usually about effectiveness rather than attendance. Treating competence as a business question, rather than a course-completion count, reduces incidents and rework and gives sales teams a credible answer to customer questionnaires.
How to implement clause 7.2
A practical route starts from the work people do, not from a catalogue of courses. One way Sterling teams approach it is below. Keep the effort proportionate: a handful of high-impact roles deserve careful definition first, and the rest can follow once the approach is proven.
- List the roles and tasks that touch information security, including contractors and part-time staff.
- For each, describe in plain words what the person must be able to do, such as operate access reviews or lead an incident call.
- Compare that picture with what you can already show for each person, whether qualifications, experience or supervised work.
- Choose an action matched to each gap: a course, mentoring, shadowing, reassignment or specialist support.
- Decide in advance how you will judge whether the action worked, preferring observed tasks or reviewed work samples over a quiz alone.
- Record the outcome briefly, keeping personal details proportionate and access-restricted.
- Revisit the picture when roles, tools or risks change, and when an incident reveals a capability gap.
Illustrative examples
Developers complete targeted learning on the risks relevant to their application. A senior reviewer then examines how they identify and address those issues in representative changes. Findings feed into mentoring and review guidance. Course completion alone would not show whether the team can apply the learning in its own code and workflow.
The manager understands production consequences but is unfamiliar with the ISMS assessment criteria. A facilitated assessment and review of subsequent decisions show whether they can evaluate consequences, prioritise treatment and exercise the assigned acceptance authority. The evidence concerns the actual role rather than a generic technical certification.
Include non-permanent and external personnel appropriately
The requirement concerns relevant work under the organisation’s control, not only permanent employees. Consider contractors, temporary staff and others whose work affects performance. The evidence route may differ, but a contract should not be assumed to prove every person is competent for every assigned task.
Relate competence to assigned responsibilities and awareness. Awareness gives people essential understanding of policy, contribution and consequences. Competence goes further where a role requires the ability to perform specific work.
Evidence and common mistakes
An auditor may compare a role’s stated needs with the person’s evidence and actual performance. Repeated errors after training can indicate that the action was insufficient, the process was poorly designed or other resources were missing. Investigate the cause rather than automatically assigning another generic course.
Common weaknesses include expired or irrelevant credentials treated as conclusive, no evaluation of development actions and unchanged competence needs after a role changes. Update the approach when services, technology or responsibilities introduce different demands. Sterling Academy learning can support development, while the organisation remains responsible for determining and evaluating role-specific capability.
Frequently asked questions
Is a course certificate enough to prove competence?
It can be part of the evidence. Compare it with the actual role and, where appropriate, practical demonstration, experience and evaluation of work.
Must everyone take the same ISO 27001 course?
No. Common awareness can be useful, but competence needs vary by role. Risk owners, auditors and technical operators may need different development and evaluation.
Do contractors fall within clause 7.2?
Relevant people doing work under the organisation’s control should be considered. Establish an appropriate evidence route rather than assuming employment status removes the need.
Build competence around real responsibilities
Talk to Sterling to map competence needs for risk owners, auditors and control operators, and decide what evidence will show that learning transfers into work. Build the relevant knowledge through ISO/IEC 27001:2022 Awareness at Sterling Academy. Certification decisions remain with an independent certification body.