ISO 27001 A.6.3 - Information Security Awareness, Education and Training

Requirement

“Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization’s information security policy, topic-specific policies and procedures, as relevant for their job function.”

Plain-language meaning

People need to know how to behave securely in their actual role. Everyone needs baseline awareness, but people with specific responsibilities need deeper training that matches their work, systems, information access, and security duties.

Training should happen early enough to be useful, should be repeated when needed, and should be updated when threats, policies, procedures, systems, roles, or incidents change.

Why this matters

Untrained personnel make avoidable mistakes. They may mishandle information, use systems incorrectly, ignore procedures, fall for social engineering, corrupt data, lose information, or bypass controls because they do not understand the risk.

Training is also a control enabler. Policies, procedures, access rules, incident reporting, classification, acceptable use, privacy, and supplier rules are weak if people do not understand them.

Implementation guidance

1. Define training audiences

Start by identifying who needs training and why.

The training plan should reflect job function and security responsibility. Generic annual slides are not enough for specialist roles.

2. Separate awareness, education, and training

Use the distinction deliberately.

This helps avoid the weak answer “we sent everyone a security email.”

3. Build a training plan

The plan should define:

• required training by role;
• mandatory induction topics;
• supplementary training for specialist responsibilities;
• timing before access or before performing high-risk tasks;
• refresher frequency;
• trigger events for updates;
• internal or external provider approval;
• competence requirements for trainers;
• evidence records and metrics.

Training can be internal, external, classroom-based, online, practical, conference-based, or on-the-job, but informal training still needs a defined scope and record.

4. Keep training current and usable

Training should be reviewed and updated when:

• policies or procedures change;
• new threats emerge;
• incidents or audit findings show knowledge gaps;
• systems, tools, or information processing practices change;
• personnel move into new roles;
• legal, regulatory, or contractual requirements change.

Training that reflects the organization’s actual culture, tools, incidents, and work patterns is stronger than generic content.

5. Measure effectiveness

Do not treat attendance as the only success metric.

Useful measures include:

• completion rate by role and department;
• assessment scores;
• phishing simulation results where appropriate;
• incident and near-miss trends;
• audit findings linked to awareness gaps;
• feedback from trainees and managers;
• practical exercise outcomes;
• overdue training items.

Metrics should drive improvement. If incidents show repeated mistakes, the training plan should change.

6. Record training in individual records

Training records should show:

• person or role;
• training title and scope;
• date completed;
• provider or trainer;
• result or assessment score where applicable;
• next refresher date;
• evidence location;
• exceptions or equivalent competence claims.

Claims of prior experience or existing qualifications can be acceptable, but they should be current, relevant, and verified, especially for key roles.

Audit guidance

Auditors should verify that training is appropriate to job function, security responsibilities, and access to information or services.

Audit testing should include:

• training policy, plan, and role-based training matrix;
• induction training records for employees, contractors, and third-party users;
• supplementary training for people with specialist security responsibilities;
• samples showing training was completed before access or before work requiring the skill;
• training material currency and alignment to current policies/procedures;
• trainer or supplier competence and approval;
• individual training records and assessment results;
• interviews with randomly selected personnel;
• evidence that training effectiveness is reviewed and improved;
• links between incidents, audit findings, feedback, and training updates.

The auditor should challenge training that is generic, stale, undocumented, or not provided until after people already perform the role.

Evidence examples

Strong evidence

• Training matrix covers employees, contractors, third-party users, managers, administrators, and specialist roles.
• Induction training is completed before access to information or services.
• Training content references current policies, topic-specific policies, procedures, and real organizational examples.
• Specialist roles have supplementary training plans.
• Individual records show completion, date, scope, trainer/provider, and assessment where applicable.
• Training effectiveness is measured and reviewed.
• Incidents, audit findings, and emerging threats lead to updated training.
• Equivalent experience or qualifications are verified rather than accepted from CV claims alone.

Weak evidence

• Annual generic security video with no role-specific training.
• Attendance list with no content, date, version, or assessment.
• Contractors and third-party users excluded.
• Training happens after system access is granted.
• Training material is stale or inconsistent with current policy.
• No evidence that managers or privileged users receive supplementary training.
• No review of training effectiveness.
• Prior experience is accepted without verification.

Common failures

Exam traps

Related controls and concepts

• A.6 People Controls MOC
• A.6.1 Screening
• A.6.2 Terms and Conditions of Employment
• Information Security Policy
• Roles and Responsibilities
• Management Responsibilities
• A.5.10 Acceptable Use of Information and Other Associated Assets
• A.5.12 Classification of Information
• A.5.24 Information Security Incident Management Planning and Preparation
• A.5.27 Learning from Information Security Incidents
• A.5.34 Privacy and Protection of PII
• Internal Audit
• Management Review
• Security Awareness and Training Plan
• Role-Based Security Training Matrix
• Security Training Record
• A.6.3 Audit Evidence Pack
• A.6.3 Audit Checklist

KB-ready summary

• A.6.3 requires appropriate awareness, education, training, and regular updates.
• Training should match job function, access, responsibilities, and current policies/procedures.
• Everyone needs baseline awareness; specialist roles need supplementary training.
• Contractors, third-party users, and relevant interested parties can be in scope.
• Training should be delivered before access or before the relevant work is performed.
• Records should show what was taught, to whom, when, by whom, and with what result.
• Training effectiveness should be measured and improved using feedback, incidents, audit findings, and changing threats.

Templates and checklists

• Security Awareness and Training Plan
• Role-Based Security Training Matrix
• Security Training Record
• A.6.3 Audit Checklist