Competence means being able to perform work that affects information security effectively. Awareness helps people understand the policy, their contribution and the consequences of failing to follow relevant requirements. Communication makes the right information available to the right people at the right time. A successful ISO 27001 people programme addresses all three, rather than treating annual course completion as the entire solution.
Clauses 7.2, 7.3 and 7.4 of the licensed ISO/IEC 27001:2022 standard provide the requirement basis. The role profiles, exercises and communication methods below are practical recommendations. They do not imply that the standard requires a particular course, certification, training provider or awareness platform.
Begin with the decisions each role makes
List the activities through which people can affect confidentiality, integrity and availability. Engineers change services, support teams verify identities, managers approve access, procurement selects providers and executives accept risk. This view identifies learning needs more accurately than assigning the same course to everyone with a company email address.
Describe the expected capability in observable terms. A support agent should be able to handle an ambiguous account recovery request using the approved process. A release owner should identify when a security exception requires escalation. A procurement lead should recognise when a proposed supplier service changes information exposure. These statements provide a basis for both development and evaluation.
Include contractors and other people working under the organisation’s control where their work affects performance. Their contractual status does not necessarily remove the need for competence and awareness. Clarify which party provides learning, how the organisation verifies suitability and what evidence it can access without collecting unnecessary personal information.
Recognise competence from more than one source
ISO 27001 recognises appropriate education, training or experience as bases for competence. Where action is needed to acquire competence, its effectiveness must be evaluated, and suitable evidence retained. See ISO 27001, Clause 7.2. A certificate may contribute evidence, but it does not automatically demonstrate capability for every task in the organisation.
Use a role profile that records the task, required capability, current evidence and any development gap. Evidence can include relevant experience, supervised work, technical review, practical exercises or formal learning. Select methods that fit the role and consequence. A critical recovery responsibility deserves more direct demonstration than familiarity with a general policy.
Avoid turning the competence record into a biography. Retain enough to support the decision that the person can perform the relevant work. Access to records should be appropriate because they may contain employment and performance information. The goal is a reliable operational judgement, not an unnecessarily detailed personal dossier.
Choose a development action that fits the gap
Not every gap requires a course. A person may need clearer instructions, mentoring, supervised practice, access to a specialist or a change in assigned responsibilities. If the process itself is ambiguous, training people harder will not resolve conflicting approval rules. Diagnose whether the problem is knowledge, skill, authority, capacity or design.
Define the intended result before selecting the action. If a team struggles to classify information, provide examples from its real workflow and practice handling borderline cases. If engineers misunderstand a secure change requirement, review actual changes and the reasoning behind decisions. Learning is more likely to transfer when it resembles the work people must perform.
Agree when effectiveness will be checked. Immediate recall can be useful, but it may not show sustained application. Review work after people have had an opportunity to use the capability. Where the task occurs rarely, a realistic exercise can provide evidence and reveal whether instructions remain usable.
Make awareness specific, timely and actionable
People should understand the information security policy, their contribution to the information security management system (ISMS) and the implications of not conforming with relevant requirements. That is the focus of Clause 7.3 in ISO 27001. Translate these ideas into situations the audience can recognise rather than presenting only abstract principles.
A project manager may need guidance on external collaboration and contract changes. A receptionist may need to understand visitor handling and escalation. A finance team may need clear routes for unusual payment or information requests. The message should explain the action expected and where to get help when the situation does not fit a simple rule.
Use timing to improve relevance. Onboarding, role changes, new tools and incidents create natural opportunities for communication. A short message before a process change can be more useful than a broad annual reminder long after the new behaviour was expected. Keep recurring awareness proportionate and update examples as working methods change.
Encourage early reporting and useful challenge
People often notice weak processes before formal monitoring does. Make it easy to report suspected incidents, confusing instructions and unsafe workarounds. Explain what information is useful and how urgent matters should be raised. A reporting route should be available when ordinary communication tools are unavailable or compromised.
Respond constructively to good-faith reports. If employees expect blame for raising an uncertain concern, they may delay until evidence is overwhelming. The organisation can maintain accountability while distinguishing deliberate misconduct from an honest mistake or a process weakness. This distinction supports learning and better information about actual operating conditions.
Close the feedback loop. Tell reporters, where appropriate, that the concern was received and addressed. Share anonymised lessons that help others recognise similar situations. Avoid exposing sensitive incident detail or personal information merely to make an awareness example more dramatic.
Design communication around decisions and audiences
Clause 7.4 requires the organisation to determine relevant internal and external communication needs, including subject, timing, audience and method. See ISO 27001 communication requirements. A practical plan also identifies the owner, approval route and fallback channel, especially for time-sensitive or sensitive messages.
Separate routine communication from incident communication. A policy update may allow scheduled distribution and acknowledgement. A suspected compromise may need rapid coordination through an approved channel with restricted recipients. A customer-facing message may require legal and account management review. Each route should be clear before urgency makes coordination difficult.
Consider language, accessibility, location and working hours. A global organisation should not assume that one live session reaches every relevant person. Provide suitable alternatives and confirm that contractors or remote teams can access the materials. Communication coverage should follow the actual workforce and service model.
Evaluate behaviour without relying on a single score
Use several evidence sources where the consequence warrants it. Course completion shows participation. A knowledge check shows some understanding. A practical exercise shows how a person applies instructions under defined conditions. Work sampling can show whether the capability is used consistently. Each has limits, and none should be presented as proof of all security behaviour.
Be careful with simulation metrics. A click rate or test score can be affected by audience, scenario difficulty, communication and sampling. Interpret it alongside reporting behaviour and process performance. Avoid using one campaign result to label an entire team careless or to claim that the organisation has eliminated a threat.
Review the learning design when results are weak. The problem may be unclear examples, inaccessible delivery, conflicting procedures or a task that people rarely perform. Improvement can involve changing the workflow or supervision, not only repeating the same course and expecting a different outcome.
Hypothetical example: an outsourced service desk practises identity recovery
A hypothetical business process provider operates a multilingual service desk for enterprise customers. Every agent completes a general security course, but quality reviews show inconsistent handling of callers who cannot provide the usual identity evidence. Supervisors sometimes approve exceptions without recording the reason.
The organisation maps the recovery decision and identifies the capabilities needed by agents and supervisors. Training uses several ambiguous requests, including a legitimate urgent case and a request involving an unavailable manager. The team clarifies which evidence is acceptable, when escalation is required and what the supervisor must record.
After supervised practice, reviewers sample real cases with appropriate protection of customer information. They find improvement in the standard route but continued uncertainty for one customer-specific process. The provider agrees a clarified instruction with the relevant customer owner and updates that role’s competence evidence. General course completion remains part of the programme, but the effective change is demonstrated in the work.
Hypothetical example: a construction consultancy improves project sharing
A hypothetical construction consultancy collaborates with external designers and site teams. Staff understand that client information is confidential, yet they use inconsistent methods to grant access to project folders. The awareness message is familiar; the practical decision about who may approve external sharing is not.
The consultancy defines a project manager capability for evaluating external access requests, confirming contractual conditions and arranging removal when work ends. It creates short examples using typical design reviews and urgent site queries. Technical support demonstrates the approved sharing route, while commercial owners explain when client approval is needed.
A pilot project reveals that temporary site staff cannot access the guidance through the usual intranet. The team changes the communication channel and includes the instruction in project onboarding. Subsequent sampling examines both approval quality and access removal. The programme addresses capability, process clarity and communication reach rather than assuming that another confidentiality reminder would solve the issue.
Maintain records that support deployment and assurance
A practical record identifies the role, expected capability, evidence, development action, evaluation result and review trigger. For awareness, retain the relevant audience, subject, delivery and evidence of reach or understanding appropriate to the method. For communication, keep approved messages and decisions where their importance warrants it.
Update records when people change roles, processes change or an event reveals a capability gap. A completed course from several years earlier may remain relevant to general knowledge but say little about a newly assigned critical task. Treat competence as a current operating judgement, not a permanent status awarded once.
Protect the records and avoid unnecessary collection. Managers and auditors may need evidence that a capability requirement is met without seeing every personal employment detail. Agree retention and access with relevant owners, especially where records cross organisational or national boundaries.
Build cover for rare tasks and key people
Some of the most important security activities happen infrequently: crisis coordination, restoration of a critical service, revocation of an emergency credential or communication with a key provider during an outage. Assign deputies and give them an opportunity to practise. A named backup who has never performed the task may not provide effective cover.
Test whether instructions support a competent person who lacks the original author’s memory. Ask the deputy to locate the current procedure, identify decision authority and explain the escalation route. Record gaps in the process as well as individual development needs. This strengthens the organisation’s capability without depending entirely on a few experienced people.
For support designing practical role-based competence and awareness arrangements, see CyberVantage360’s ISO 27001 service or discuss your workforce and control responsibilities. Any specific learning or platform scope should be confirmed against the intended audience and capability needs.
Use process changes as learning feedback
When a team repeatedly asks the same question, examine whether the instruction or workflow is unclear. Capture the question, the decision made and any change needed to the procedure. This converts everyday support into evidence about where the organisation needs better guidance.
After a process is revised, tell the affected roles what changed and why. Retire obsolete examples and ensure that supervisors use the same decision rules. Conflicting messages from training materials and operational managers can undermine otherwise sound learning, so review both sources when evaluating whether the change has taken effect.
Frequently asked questions
Does everyone need the same security course?
No. A common awareness foundation may be useful, but competence needs should follow the work people perform. Roles that approve access, develop systems or coordinate incidents need relevant capabilities and suitable evidence. A uniform course alone is unlikely to address all of those responsibilities.
Does ISO 27001 require a particular professional certification?
The standard requires necessary competence and appropriate evidence, not one universal qualification for every role. Relevant education, training and experience can contribute. The organisation should decide what demonstrates capability for the task and evaluate development actions where they are needed.
Is an attendance record sufficient evidence?
It can show participation in a learning activity, but it may not establish that the person can perform a critical task. Use evaluation suited to the capability, such as supervised work, practical exercises or relevant work samples, and record the limitations of the evidence.
How should contractors be included?
Identify the work they perform under the organisation’s control and the security capabilities and awareness it requires. Agree responsibilities with the employing or supplying organisation where relevant. Ensure that instructions, reporting routes and necessary evidence are available without assuming that employment status determines the entire obligation.