Awareness
People working under the organization's control need to know about the information security policy, how they contribute to the effectiveness of the ISMS including the benefits of better security performance, and what follows from not....
What the requirement asks
People working under the organization's control need to know about the information security policy, how they contribute to the effectiveness of the ISMS including the benefits of better security performance, and what follows from not conforming with ISMS requirements.
What the guidance adds
Awareness is about what a person knows and does, not what was published. The guidance asks for the policy, the person's contribution to the system and the consequences of not following it, in language the person can use. Test it by asking a person in the corridor, not by reading the induction slide.
Status of the guidance. The guidance lens for 7.3 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep an awareness programme covering the policy, individual contribution and consequences of non-conformity with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- AwarenessAn awareness programme covering the policy, individual contribution and consequences of non-conformity
- AwarenessCompletion records and knowledge checks
- AwarenessInterview evidence that staff can describe the policy and their role
- AwarenessCoverage of contractors and temporary staff
The question an assessor will ask
An assessor will ask for an awareness programme covering the policy, individual contribution and consequences of non-conformity. The test for 7.3 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Awareness covers phishing only, not the policy or individual contribution
- Consequences of non-conformity are never explained
- Contractors receive no awareness material
- Staff interviewed cannot describe the policy
Before the next audit
Before the next audit, test this against one live record: awareness covers phishing only, not the policy or individual contribution.