ISO 27001 clause 7.3: Information security awareness
ISO 27001 clause 7.3 requires people doing work under the organisation’s control to understand the information security policy, their contribution to ISMS effectiveness and the implications of not conforming with its requirements. Awareness should help people make better everyday decisions. It is not a memory test of standard clause numbers.
What clause 7.3 requires in practice
Clause 7.3 is about what people understand, not about whether a training session took place. Everyone doing work under the organisation's control needs to be aware of three things.
- The information security policy, in terms of what it means for their own role.
- How their own work contributes to the effectiveness of the ISMS, including the benefit of better security performance.
- What follows if they do not conform to ISMS requirements.
The clause leaves the method open. Induction talks, short briefings, posters, team huddles, simulated phishing and manager conversations can all serve, provided they actually reach people and are understood. The output is a workforce that can explain, in its own words, what is expected and why. Awareness covers anyone under the organisation's control, so temporary staff, contractors and, where relevant, suppliers' personnel working on site or with access to systems fall within it, not only permanent employees.
Make the message relevant to the role
Translate policy into the situations people encounter. A service-desk employee may need to recognise a suspicious request and use a safe escalation route. A project manager may need to understand why subcontractor access cannot continue indefinitely. People should know how their actions affect confidentiality, integrity or availability, including consequences for colleagues and customers.
Explain benefits as well as consequences. Reliable handling and reporting support service continuity, trust and fewer avoidable mistakes. A programme based only on blame can discourage people from reporting uncertainty or errors promptly. Communication should support the organisation’s actual responsibilities and rules.
Choose channels that reach the workforce
Onboarding, briefings, short learning modules, scenario discussions and reminders can work together. Consider language, literacy, shifts, remote work and access to devices. Posting a policy on an intranet is weak evidence of awareness if the people who need it rarely use that intranet.
Set refresh arrangements based on need and change. A new service, recurring misunderstanding or revised instruction can justify targeted communication. Clause 7.3 does not prescribe a universal annual course or a particular delivery platform. Whatever approach is used, include relevant temporary and contracted personnel working under the organisation’s control.
Awareness differs from competence. A general module can explain that incidents must be reported; it does not automatically qualify someone to investigate them or decide notification obligations. Link people to the appropriate specialist rather than treating every employee as a security expert.
Why awareness matters to the business
People are the route through which most security incidents reach an organisation, whether through a convincing email, a shared password or a document sent to the wrong recipient. Awareness is the cheapest control available because it applies everywhere work happens. It also supports commercial trust: customers who audit a supplier often speak to ordinary staff, and a receptionist or support agent who cannot describe the basics undermines an otherwise strong programme. Auditors reach the same conclusion by interviewing people on the floor. Where awareness is real, incidents are reported sooner, policy exceptions are raised rather than hidden, and management spends less time reacting to avoidable mistakes.
How to implement clause 7.3
Awareness works best when it is short, role-relevant and repeated, rather than a single annual presentation. A workable approach is outlined below. Keep the tone practical, so staff see awareness as help with their own work rather than a compliance burden imposed from outside.
- Translate the information security policy into a few plain-language messages for each audience, such as office staff, developers and contractors.
- Include the personal angle in each message: how this person's daily work helps or harms security, and what the organisation gains from doing it well.
- Explain the consequences of ignoring requirements, including disciplinary and contractual effects, in a calm and factual tone.
- Deliver at joining and refresh through varied channels, including manager briefings and real examples from your own incidents.
- Make sure contractors and temporary workers receive the same messages before they get access.
- Test understanding informally through short questions, walk-arounds or simulated events, and adjust content where answers are weak.
- Keep a light record of what was delivered to whom, so you can show reach.
Evidence an auditor expects for clause 7.3
An auditor will look for proof that messages reached people and were understood, not just a count of attendees. Typical evidence covers several kinds of observation and record.
- Interviews with staff at different levels, asking what the policy means for their job and what they would do on spotting something suspicious.
- Records of induction and refresher delivery, including contractors and temporary workers.
- Examples of communications used, such as briefings, intranet notes or poster campaigns.
- Results of any awareness checks or simulations, with follow-up where results were poor.
- Observation of working areas for consistent behaviour, such as locked screens.
No particular document title is mandatory; the test is whether people are demonstrably aware.
Illustrative examples
A team handles frequent requests involving customer records. Briefings use a scenario where a caller pressures an employee to bypass an identity check. Staff practise recognising the conflict and using the approved escalation route. Supervisors then review representative interactions to understand whether the message affects behaviour.
Short-term personnel need to know where approved drawings are kept and why uncontrolled links can expose information or cause work from an obsolete version. The project briefing shows the actual route and reporting contact. Awareness is checked through discussion on site rather than assuming a head-office email reached everyone.
Evaluate understanding proportionately
Ask people to explain what they would do in a relevant situation and where they would obtain help. Review recurring mistakes and questions. A quiz can provide useful evidence, but completion statistics alone do not show that employees understand their contribution or the implications of failing to follow requirements.
Clause 7.3 does not separately prescribe a named awareness-record format. Learning records, briefings, feedback and observed practice can support the wider evidence. Protect personal information and avoid public blame when using learning results. The purpose is an effective programme, not a league table of embarrassment.
Common weaknesses
Generic messages can miss the actual risks of a role. Other weaknesses include untested assumptions that contractors were briefed, inconsistent messages across shifts and awareness content that contradicts operating instructions. If staff cannot find a reporting route or face unrealistic workloads, more reminders alone will not fix the underlying problem.
Connect awareness with communication and relevant control arrangements, including security education and training. Use feedback to improve the system as well as the learning material.
Frequently asked questions
Does annual training automatically satisfy clause 7.3?
No. It can contribute, but people need relevant understanding in practice. Check reach, content, changes and how the learning affects everyday decisions.
Should awareness explain consequences of nonconformity?
Yes, in a clear and appropriate way. Explain operational and security implications and relevant responsibilities without relying solely on fear or blame.
How do we check awareness for staff without regular computer access?
Use suitable channels such as briefings and practical scenarios, then check understanding. The delivery method should fit the workforce rather than exclude it.
Help employees make the right security decisions
Talk to Sterling to shape awareness around the policy, individual contribution and consequences that matter to your workforce, using realistic role-specific situations. Build the relevant knowledge through ISO/IEC 27001:2022 Awareness at Sterling Academy. Certification decisions remain with an independent certification body.