ISO/IEC 27001 training: who needs what, and what counts as evidence of awareness and competence

Clause 7: competence, awareness and retained evidence

ISO/IEC 27001 keeps its people requirements in clause 7, Support. Both sub-clauses that matter here reach past the payroll to temporary staff, agency workers and contractors.

7.2 Competence covers anyone whose work affects information security performance. The organisation decides what each such role requires, confirms that its holders meet that bar through education, training or experience, acts where they fall short, evaluates whether the action worked and retains documented information as evidence. The standard's note lists mentoring, reassignment, and hiring or contracting competent people alongside training.

7.3 Awareness covers every person doing work under the organisation's control. Each must be aware of the information security policy, of their contribution to the effectiveness of the ISMS, including the benefits of better security performance, and of the implications of not conforming. Auditors test it by conversation: knowing what to do when a supplier's bank details change by email counts for more than reciting the policy.

Neither sub-clause sets a qualification or an hour count; you define the criteria.

Annex A's people theme: the controls that shape training

The people theme, A.6, holds eight controls, selected through risk treatment and recorded in the Statement of Applicability. Five bear directly on training:

• 6.1 Screening: background verification before people join and on an ongoing basis, lawful and proportionate to the risk; those who screen need to know the rules.
• 6.2 Terms and conditions of employment: contracts state the security responsibilities of the person and the organisation, which induction should explain.
• 6.3 Information security awareness, education and training: for personnel and relevant interested parties, with regular updates on the policies and procedures relevant to each job.
• 6.4 Disciplinary process: formalised and communicated, so people know the consequence of a violation before one occurs.
• 6.5 Responsibilities after termination or change of employment: duties that outlast a role, defined, enforced and communicated when someone leaves or moves.

Confidentiality or non-disclosure agreements (6.6), remote working (6.7) and information security event reporting (6.8) complete the theme. Clause 7.3 sets an awareness floor whatever the Statement of Applicability says; control 6.3 builds the role-based programme on it. Annex A: the 93 controls by theme, explained

Who needs what, from the boardroom to the supplier's engineer

Top management

Leaders approve the policy, agree risk acceptance criteria, often accept residual risk and review the ISMS. Brief them on clause 5, security metrics and the impersonation and payment-fraud emails aimed at senior people.

The ISMS owner

Whoever runs the ISMS needs the 2022 edition with Amendment 1 in depth, plus the risk method, the Statement of Applicability, incident handling and the audit programme. An implementer course is common, not mandatory.

Control owners

HR typically owns screening, contracts and leavers; facilities, physical security. Each owner must know the control's purpose, its frequency, the record it leaves and what to do when it fails.

Developers and IT operations

Technical teams run much of the technological theme: secure development, configuration, logging, backup and privileged access. Give them role training in secure coding, your hardening standards and incident response, which awareness modules never reach.

Everyone in scope

At induction and at regular intervals: the policy in plain terms, classification, passwords and multi-factor authentication, clear desk and screen, remote working, phishing and where to report an event. Keep it short, tested and specific to you.

Suppliers and contractors

Contractors and agency staff under your direction fall within clause 7.3 and take the same induction. People a supplier manages are reached through controls 5.19, Information security in supplier relationships, and 5.20, Addressing information security within supplier agreements: write screening, awareness and confidentiality duties into the agreement and check the evidence.

An ISMS training matrix to adapt

Adapt the rows to your structure, systems and risks.

Keep the matrix under document control and revise it when a system, supplier or role enters the scope, after an incident exposes a knowledge gap, and when risks are reassessed.

Phishing simulations and awareness metrics as evidence

Auditors sample people, not files: they compare records with role criteria, then ask what the person would do with a suspicious email or a lost laptop.

Phishing simulations

The standard does not mention them and certification does not depend on them, yet they persuade because they measure behaviour. Agree the programme with management and HR, respect employment and privacy law, and send people who click to a short lesson: control 6.4's disciplinary process is for policy violations, and a click on a test email is usually a training need.

Awareness metrics

Clause 9 asks you to monitor and measure the ISMS and its controls, and awareness lends itself to that:

• induction awareness completed within an agreed period of joining, and refreshers by their due date;
• test pass rates and the questions most people miss;
• phishing click rate, report rate and time to first report, tracked across campaigns;
• security events reported by staff outside IT, a sign that control 6.8 is understood.

Take the trend to the management review with a decision attached, such as targeted training for a team whose report rate is falling.

Where awareness evidence breaks down at audit

• Attendance presented as competence. A sign-in sheet shows presence, not what an administrator can do.
• One course for everyone. Developers sit the reception module, and technological controls lack trained owners.
• Contractors left out. They often combine the widest access with the thinnest records.

ISO/IEC 27001 internal audit: planning, conduct and reporting

Sterling Academy e-learning and internal auditor training

For the workforce as a whole, Sterling Academy offers e-learning, and these courses fit the matrix above:

• ISO/IEC 27001:2022 Awareness, for everyone in scope, on the part each person plays in protecting information.
• Documented Information Management, for the ISMS owner and those who draft, approve or control policies and records.
• Nonconformity Management, for control owners and managers who handle findings and corrective action.
• Risk Management, for risk owners and managers who identify, assess and treat risk.

Learning checks run through each course, and completing the final exam earns a numbered Sterling Academy Certificate of Completion, a tested record for the everyone row.

Internal auditor training, as applicable to your standard, belongs to the consulting engagement rather than the Academy catalogue: your Sterling consultant trains your internal audit team on ISO/IEC 27001 and your own ISMS, leading to a Certificate of Competence.

Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

Contact us about Academy access

ISO/IEC 27001 training: questions buyers ask