Competence
The organization must decide what competence is needed by people working under its control whose work affects information security performance; make sure they are competent through education, training or experience; where applicable act....
What the requirement asks
The organization must decide what competence is needed by people working under its control whose work affects information security performance; make sure they are competent through education, training or experience; where applicable act to acquire the competence and check those actions worked; and keep documented evidence of competence. The note gives examples such as training, mentoring or reassigning current staff, or hiring or contracting competent people.
What the guidance adds
Competence is expected to be defined for the roles that affect information security performance, then evidenced. The guidance looks for the required competence, the way it was obtained, the record of the person's competence and the action taken when a gap appears. A training attendance sheet is not a competence record.
Status of the guidance. The guidance lens for 7.2 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep competence requirements for roles affecting information security performance with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Competence requirementsCompetence requirements for roles affecting information security performance
- Competence requirementsTraining, qualification and experience records for people in those roles
- Competence requirementsRecords of actions taken to close competence gaps and evaluation of their effectiveness
- Competence requirementsCoverage of contractors and others working under the organization's control
The question an assessor will ask
An assessor will ask for competence requirements for roles affecting information security performance. The test for 7.2 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Competence requirements are not defined, only training attendance recorded
- The effectiveness of training is never evaluated
- Contractors are left out of competence management
- Records of competence are missing for key security roles
Before the next audit
Before the next audit, test this against one live record: competence requirements are not defined, only training attendance recorded.