Information security awareness, education and training
Purpose
Ensure staff and relevant outside parties know about and carry out their information security duties.
How to meet this control
In short: Provide regular awareness training relevant to roles.
- Step 01Run a structured annual awareness programme using a platform such as KnowBe4 or Hoxhunt, with role-specific modules for developers, finance and general staff
- Step 02Deliver induction training within the first week for new starters and refresher training when someone moves into a higher-risk role
- Step 03Run regular phishing simulations and route repeat clickers into targeted follow-up training
- Step 04Track completion centrally and escalate overdue staff to their managers, keeping a record of pass rates and quiz scores
- Step 05Reinforce the message between formal sessions with posters, intranet articles, Slack or Teams reminders and short briefings on current threats
- Step 06Provide deeper technical training for engineering and ops teams, such as secure-coding or cloud-hardening courses, to build specialist competence
Tip: Annual training plus phishing simulations, with completion tracking.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Set up an awareness, education and training programme aligned to the security policy and procedures
- ›Deliver training regularly, and give initial training to new joiners and to people changing roles
- ›Test understanding at the end of each activity to confirm the learning stuck
- ›Use varied channels such as campaigns, posters, newsletters, briefings, e-learning and emails
- ›Cover core topics: management commitment, the rules to follow, accountability, basic procedures and where to get help
- ›Deliver specific technical training so technical teams can configure and maintain security
- ›Use different formats such as classroom, mentoring, on-the-job rotation, self-study and online learning
- ›Encourage technical staff to keep skills current through newsletters, conferences and professional events
Audit evidence to keep
- - Training completion reports showing dates and pass rates per employee
- - The annual awareness training plan or curriculum
- - Phishing simulation results with click and report rates over time
- - Sample training materials such as slide decks or e-learning modules
- - Records of role-specific technical training for the engineering team
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.6.3. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.