Information security awareness, education and training

What the requirement asks

The organization's personnel and relevant interested parties are to receive information security awareness, education and training suited to their jobs, together with regular updates on the policy, topic-specific policies and procedures. Purpose: have staff and relevant outside parties know what security asks of them and do it. Guidance: build a programme aligned with the policies and procedures that reflects the information to be protected and the controls in place. It runs periodically, with initial sessions for new starters and for people moving into roles with substantially different security requirements, and understanding is tested at the end of each activity to check that knowledge transferred and the programme works. Awareness: aim to make people understand their responsibilities and how to meet them; plan by role, covering internal and external people such as consultants and supplier staff; schedule activities regularly so they repeat and reach newcomers; draw on incident lessons; and use varied physical or virtual channels (campaigns, booklets, posters, newsletters, websites, sessions, briefings, e-learning, email). Content covers management's commitment; the need to know and comply with applicable rules and obligations from policies, standards, laws, contracts and agreements; personal accountability for actions and omissions and the duty to protect the organization's and others' information; basic procedures such as reporting events (6.8) and baseline controls such as password security (5.17); and where to get further advice and material. Education and training: identify, prepare and deliver a training plan for technical teams that need particular skills to configure and maintain the required security of devices, systems, applications and services, and acquire any missing skills. Consider lectures, self-study, mentoring by experts or consultants, job rotation, hiring skilled people or consultants, delivered in classrooms, remotely, online or self-paced; technical staff keep current through publications, conferences and professional events. Other information: explain why, not only what and how, so people see how their behaviour helps or harms; the programme can be combined with other training such as privacy, ICT or safety. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Awareness, education and training should change behaviour. The guidance asks for the audience, the content, the frequency, the test and the follow-up for the people who fail.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel and one live sample together.

Evidence an assessor asks for

• Security awarenessA documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
• Security awarenessCompletion records for initial training of new starters and role changers and for periodic refreshers
• Security awarenessAssessment results testing understanding at the end of training activities
• Security awarenessAwareness materials across channels covering management commitment, obligations, accountability, event reporting and baseline controls
• Security awarenessA training plan for technical teams with identified skill gaps and actions taken to close them
• Security awarenessEvidence that incident lessons were fed into awareness content

The question an assessor will ask

An assessor will ask for A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel, then trace it to the system it protects. For A.6.3 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Training is a single annual click-through with no test of understanding
• Contractors and supplier staff are excluded from the programme
• Technical teams receive no specialist security training for the systems they manage
• Content is generic and never updated after incidents or policy changes

Before the next audit

Before the next audit, check one live sample for this gap: training is a single annual click-through with no test of understanding.