Information security awareness, education and training

Plain-language summary

Making sure everyone, from the shop floor to the boardroom, knows the security rules that apply to them, why they matter and how to report a problem — through an ongoing awareness programme plus role-specific training kept current as threats and policies change.

What the clause is really asking

People are the most attacked part of any organisation, and this control asks for a programme that changes what they do, not just what they have heard. It has three layers: awareness for everyone (policy, phishing and social engineering, how to report); education and training matched to role, such as secure administration for IT staff, secure coding for developers and payment-fraud red flags for finance; and updates when policies, threats or roles change. The programme should be planned, delivered and checked for effect. Do not confuse it with clause 7.3, which only asks that people know the policy, their part in it and the consequences of not conforming. The common misunderstanding is that an annual click-through module satisfies the control; research on awareness training has found that once-a-year modules make little lasting difference to behaviour, while frequent short modules combined with an easy reporting habit do. In South Africa, POPIA Regulation 4(1)(e) makes the Information Officer responsible for internal awareness sessions, and FSCA/PA Joint Standard 2 of 2024 expects financial institutions to run cyber awareness programmes, an expectation they increasingly pass to suppliers.

What auditors look for

Auditors ask for the awareness and training plan for the year and compare it with what was delivered: completion records by department, including shift workers and contractors who often fall outside the learning system. They interview a few people and ask, in plain words, how they would report a suspicious email and what the clear desk rule is. They ask for role-based training for privileged users and developers, and how effectiveness is measured, usually phishing simulation click and report rates over time. They check new starters are covered before they get access. The hard question: what changed in your programme after the last incident or simulation result?

Typical evidence

Awareness and training plan with topics, audiences and frequency; induction security module records; completion records by department, including contractors and shift workers; role-based training records for IT administrators, developers and finance; phishing simulation click and report rates over time; awareness material such as posters, briefings and toolbox talks; effectiveness review and resulting changes; Information Officer awareness session records.

How to comply — recommendations

Write a one-page annual plan: a short induction module completed before system access, a five-minute module or briefing on one topic every month, quarterly phishing simulations, and role-based training for IT, finance and anyone handling customer design data. On the shop floor, use the toolbox-talk or shift-briefing slot you already run for safety rather than a laptop module. Put a report-phish button in the mail client and celebrate reports, not just low click rates. Track completion, click rate and report rate monthly and take them to management review. After each incident or simulation, pick the next month's topic from what went wrong. Record the Information Officer's POPIA sessions as part of the same plan.

Common nonconformities

No awareness plan, only an annual module; contractors, agency and shift workers never trained; no role-based training for privileged users; completion not tracked, or below target with no action; effectiveness never measured; interviewed staff unable to say how to report an incident; content out of date with current policies; new starters given access before induction.

Resources for this clause

• ArticleWhat ISO 27001 actually requires for security awareness and training — clauses 7.2 and 7.3, control A.6.3, and what the auditor tests on the floor
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free courseInternal Auditor coursePlanning, running and reporting internal audits, with a verifiable certificate.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.