Awareness

Plain-language summary

Making sure every person working under the organisation's control knows the information security policy, how their own behaviour contributes to the ISMS — and what better security buys the organisation — and what happens when they or the organisation fail to conform.

What the clause is really asking

Awareness is the clause behind the whole security-awareness-training industry, and it is modest in its wording: everyone working under the organisation's control has to know the information security policy, understand how their own work contributes to an effective ISMS — including what the organisation gains when security performance improves — and understand what follows from not conforming to the ISMS requirements. That includes contractors and temporary staff, not only employees. The detailed, programme-level requirement — training on phishing, passwords, data handling, incident reporting — sits in Annex A control 6.3, and the evidence that it works sits in 9.1. In South Africa, POPIA Regulation 4(1)(e) separately requires the Information Officer to ensure internal awareness sessions are conducted, and the FSCA/PA Joint Standard requires financial institutions to run a cybersecurity awareness programme for all users — this clause is where those obligations meet the ISMS. The research is clear that a single annual video changes little; frequent, short, relevant content plus a reporting habit does.

What auditors look for

Auditors test awareness on the floor, not in the file. They stop staff and contractors and ask: what does the policy expect of you, what would you do if you received a suspicious email, where do you report a lost device, what happens if you share your password? They then check the records: induction content, awareness sessions, completion rates, and whether contractors and temps are covered. They look for 'implications of not conforming' being communicated — disciplinary consequences and the business impact — and for evidence the programme is refreshed rather than repeated.

Typical evidence

Awareness programme or calendar; induction materials covering the policy and the three required elements; attendance or completion records including contractors; communications (posters, briefings, nudges); results of awareness checks (quiz scores, phishing-simulation results, incident-reporting rates); evidence of refresh and of coverage of new starters.

How to comply — recommendations

Run a twelve-month awareness calendar: one short topic a month (ten minutes, one message), an induction module for every new starter in week one, and a standing 'report it here' instruction on every channel. Cover the three required elements explicitly — the policy, each person's contribution and the consequences of not conforming — and record who attended, including contractors. Measure behaviour, not attendance: the rate at which people report suspicious emails is the single best indicator. Keep the records in one register mapped to this clause, Annex A 6.3 and POPIA Regulation 4(1)(e), so one file answers three auditors. Qlause's Cyber Aware training package is built to this calendar.

Common nonconformities

Staff and contractors unable to describe the policy or how to report an incident; awareness limited to an annual presentation with no refresh; contractors and temporary staff excluded; implications of non-conformance never communicated; no records of attendance or completion; no measurement of whether awareness is improving; new starters working for months before any induction.

Resources for this clause

• ArticleWhat ISO 27001 actually requires for security awareness and training — clauses 7.2 and 7.3, control A.6.3, and what the auditor tests on the floor
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.