ISO 27001 competence and awareness: what auditors test

What ISO 27001 competence and awareness requirements mean for your team

When a customer questionnaire or contract clause asks for ISO 27001, the organization must define, provide and evidence competence under clause 7.2 and awareness under clause 7.3 of ISO/IEC 27001:2022. Most of this work is internal time: managers defining the skills each role needs, staff completing training, and records showing that both happened. Any training content the organization buys is a secondary cost. The organization owns these requirements. An implementation partner can design the competence matrix, set up the records and build the training workflow, but only the independent certification body decides whether the organization conforms.

Clause 7 applies whoever does the implementation work. Resources (7.1), competence (7.2), awareness (7.3), communication (7.4) and documented information (7.5) are required of the organization even when an outside firm drafts the procedures, so outsourcing the setup never removes the duty to run it. For competence, the practical starting point is a list of security-relevant roles, the skills each one needs, and evidence that each person holds those skills, such as training records, qualifications or supervised experience, with actions taken where gaps appear. For awareness, the organization must show that people know the information security policy and their own contribution to it, and it must keep that evidence current.

Do not budget from a generic figure. No cost or duration is supplied for this topic, so ask any consultant or training provider for a fixed-scope quote based on your headcount, role catalogue and existing learning platform, and confirm with your certification body how it will sample training records during audit. Before you commit, check three things: which roles your ISMS scope actually covers, whether your current learning system can record completion with dates and results, and who signs off competence decisions. Those answers determine most of the effort.

How clause 7.2, clause 7.3 and control A.6.3 differ

This table compares what clause 7.2, clause 7.3 and control A.6.3 each ask the organization to show, who they reach and which record usually proves them. Read across a row to see how the three differ, and read down the evidence column to see what an assessor will ask to see.

Requirement	What the organization must show	Evidence that usually proves it
Clause 7.2 competence	People doing work that affects information security performance are competent on the basis of education, training or experience, and the organization acts to acquire that competence where gaps exist.	Role descriptions with required skills, records of qualifications or experience, and records of actions taken where a gap was found.
Clause 7.3 awareness	People working under the organization's control know the information security policy, their contribution to the ISMS, and the benefits of better performance and the consequences of nonconformity.	Acknowledgement records for the policy, briefing or onboarding content, and staff responses to awareness activities or short knowledge checks.
Control A.6.3 training	Personnel and relevant interested parties receive awareness, education and training suited to their job function, with regular updates on policies and topic-specific procedures.	Training plan mapped to job functions, attendance or completion records, and dated records of updates issued when policies or procedures change.
Who it applies to	Clause 7.2 targets people whose roles affect security performance. Clause 7.3 targets everyone working under the organization's control. A.6.3 also reaches relevant interested parties such as certain contractors.	A role-to-requirement list that shows which groups fall under each requirement, reviewed when roles change.
Primary question	Clause 7.2 asks whether the right people can do the job. Clause 7.3 asks whether people understand the policy and their part in it. A.6.3 asks whether training is tailored to function and kept current.	Assessors often sample one role from each group and trace it back through the three records.
Typical failure point	Competence claims without records of the role's requirements, or awareness treated as a one-off induction with no later updates.	Missing dated evidence, or records that show completion but not the content or the role the person holds.
Where it is assessed	Competence is tested through interviews and records for key roles. Awareness is tested through staff interviews across the organization. A.6.3 is tested against the training plan and its records.	Confirm with the certification body which samples it will take and how it will select roles and staff.

Who does what for competence and awareness evidence

The organization owns competence and awareness. Its leaders define which roles affect information security performance, decide what competence means for each role, choose the training and awareness activities, and approve the records that show the outcome. Those decisions are part of the management system, so they cannot be delegated to an outside party and then treated as the organization's own.

Role definitions: Set the security-relevant roles, the required knowledge and skills for each, and who approves changes to those criteria.
Competence decisions: Decide whether each person is competent, what action closes any gap, and record the basis for that decision.
Training and awareness plans: Choose content, audiences and frequency, and link them to policies, topic-specific rules and incidents.
Sign-off: Review completion and effectiveness reports, and approve the outcome through the management system, including management review inputs.
Ongoing ownership: Keep records current when people join, change roles or leave.

Before engaging anyone, confirm that a named internal owner can explain the competence criteria and approve each record without referring to an outside party.

How an auditor tests competence and awareness

The auditor works from roles to people to records, then tests whether staff can explain the policy in their own words. Each step produces evidence the organization should be able to hand over before the audit visit.

Reviewing role descriptions and competence criteria
The auditor starts by reading the documented roles that touch the ISMS, such as system administrators, developers, service desk staff, and managers who approve access or risk decisions. They check that each role states the knowledge, skills, and experience needed to do the work securely, and that the criteria are approved by an accountable owner. The output to hand over is a current role register or job description set with competence criteria and a version history. The step is complete when the auditor has a list of roles to sample.
Sampling staff against those roles
Next the auditor selects a sample of people from the roles identified and compares each person's position with the criteria written for it. They look for gaps between what the role requires and what the person has demonstrated, such as a new administrator with no recorded privileged access training. The organization should provide a current staff list mapped to roles, including contractors where they perform ISMS-relevant work. The step closes when each sampled person is either matched to their criteria or flagged for follow-up.
Checking competence actions and their records
For each flagged or sampled person, the auditor asks what action the organization took to acquire the necessary competence. Acceptable actions can include training, mentoring, supervised work, or certification, and the auditor checks whether the action was effective, not only that it happened. The organization should hand over training records, completion evidence, assessment results, and notes showing how the action was judged effective. The step is complete when each sampled gap has either evidence of closure or a recorded nonconformity.
Verifying awareness of the policy and ISMS
Under clause 7.3 the auditor checks that people doing work under the organization's control know the information security policy, their contribution to the ISMS, and the consequences of not conforming. This is separate from the training record itself. The organization should show the awareness content, the audience it reached, and how it is kept current when the policy changes. The output is an awareness plan or program with delivery records and version dates. The step closes when the auditor knows which awareness activities reached which groups.
Interviewing staff on the policy and their role
The auditor interviews a sample of staff across the sampled roles and asks them, in plain language, what the security policy requires of them, what they would do with a suspected incident, and where they would find the procedures. Staff answers show whether awareness has reached the people doing the work. The organization can prepare by making sure policy documents are findable and that managers know who will be interviewed. The output is the auditor's interview notes, which are compared with the training and awareness records. The step is complete when answers are reconciled with the records.
Comparing records with interview findings
The auditor brings the role criteria, competence records, awareness records and interview notes together and looks for contradictions. A record that says a team completed training is weak evidence if staff in that team cannot describe the policy. The organization should be ready to explain any mismatch and show the corrective steps it has taken. The output is the auditor's working list of findings, which is discussed at the closing meeting. The step closes when every finding is either supported or resolved.
Raising nonconformities where evidence is missing
Where competence has not been determined, awareness has not reached relevant people, or records cannot support the claim, the auditor raises a nonconformity against the relevant clause. The finding is written with the evidence gap described and the requirement referenced. The organization then decides on a correction, a root cause analysis, and a corrective action, and provides evidence that the action is effective. The output is the nonconformity report and the organization's corrective action record. Only the independent certification body decides whether findings are closed and whether certification is granted.

What makes competence evidence harder or easier to produce

Clauses 7.2 and 7.3 ask for records that show who needed which competence, who got it and who was aware of what. The effort of producing those records depends less on the training content than on how the organization is structured, how many places records live, and whether roles were defined before training began. The cards below cover the drivers that most often decide how much work an assessment will cost.

Number of roles and locations

Every distinct role needs its own competence requirement, and every location can add local obligations such as site-specific procedures or language needs. A small team with five roles can keep requirements in one document, while a group with dozens of roles across several countries needs a role register that maps each role to its training, its owner and its review date. Check that each site's records use the same role names as head office, so an auditor can trace one person's record from the job to the training.

Contractor and third-party staff

Contractors often work inside the ISMS without appearing in the employee HR system, so their awareness and competence records tend to be missing. Clause 7 applies to the people doing the work, so the organization needs to decide whether contractors complete its own training or evidence equivalent training from their employer. Put that obligation in the contract, and keep a list of active contractors with their training dates alongside the employee records.

Systems that hold training records

Training evidence is often split across an LMS, a spreadsheet, an HR platform, sign-in sheets and email confirmations. Each extra source adds a reconciliation step before an audit and a chance that a completion is recorded in one place and not another. Choosing one learning record source, even if other tools feed it, lets the organization answer 'who completed what, and when' with a single export. Open-source learning platforms such as Moodle can serve as that source if completion rules are configured deliberately, because activity completion is only recorded when the conditions set for the activity are met.

Staff turnover

High turnover means a steady stream of new starters who must be made aware of the policy and trained for their role, along with leavers whose access and training obligations must end cleanly. If onboarding depends on someone remembering to send a training invitation, some starters will go untrained for months. Link training to the access request so that a role cannot receive system access until its required awareness module is complete, and record the date of each completion against the role, not only the person.

Roles defined before training starts

Training that starts before the organization has defined roles and their required competence produces records that cannot be checked against anything. An auditor will ask what competence a role needs, how the organization decided that, and whether the training addressed it. Write the competence requirement for each role first, including how it was determined, then select or build the training. Retain the role definitions with their version dates so that a change in responsibilities can be traced to a change in training.

Building role-based training that produces ISO 27001 evidence

Role-based training under ISO 27001 starts with a simple decision: which functions in the organization need which knowledge, and what each one must be able to do after training. Group staff by function, such as engineering, support, finance, managers and administrators, and for each group list the policies and procedures it must know. An engineer with production access needs the access control, change and secure development procedures. A support agent needs the incident reporting and customer data handling procedures. A finance user needs the procedures for supplier payments and data requests. Clause 7.2 expects the organization to determine the competence each role needs, make sure people have it, and keep records that show it. Clause 7.3 then requires that people know the policy and their contribution to the ISMS. Writing the role map first gives the auditor a clear link from a job to a required competence and from that competence to a training record.

Evidence depends on being able to tie each completion to an identifiable learner and a date. A training record should show who took the course, which version of the content they received, when they completed it, and what they were tested on or attested to. Open-source learning platforms such as Moodle can record activity completion, but the platform only counts what the organization configured it to count. Completion can be triggered by viewing an activity, by receiving a grade, or by a learner ticking a box, so the organization must define the completion rule for each course and confirm that the rule proves the competence it claims. A rule based only on viewing a page is weak evidence for an assessed skill. Confirm the rule with the certification body's auditor before relying on it, and keep the course content, quiz design and pass marks under the organization's own control.

Set a review step that catches gaps before the auditor does. Each time a policy or procedure changes, identify the roles affected, update the relevant course, and record who must retake it and by when. Reconcile training records against the current staff list and role map so leavers, movers and contractors do not appear as trained or as missing without explanation. Keep the role map, course versions and completion exports under document control, since clause 7.5 applies to them too. The effort in this work is mostly internal: someone must own the role map, approve course content and check records each cycle. Any external help should be scoped in writing so the organization keeps the decisions about what staff must know and how competence is judged.

What to have in place before the audit

Clauses 7.2 and 7.3 are tested through records, not statements of intent. The six items below are the records an assessor will ask to see, and each one should be sampled against the others before the certification body arrives.

Competence criteria per role

Write down the knowledge, skills and experience each role needs for its information security duties, such as system administrators, application developers, service desk staff and the people who own risk treatment. Under clause 7.2, the organization must determine these criteria and keep evidence that people meet them. Check that every role in the ISMS scope has a criteria entry and that the entry names the duties it covers.

Training matrix linked to the SoA

Build a matrix that maps each role to the required training and to the Annex A controls that role operates, including A.6.3. The Statement of Applicability should point to the matrix so an assessor can trace a control to the people who must be trained on it. Check the link in both directions: pick a control marked as implemented and confirm the matrix names the roles that depend on it.

Dated awareness communications

Keep a calendar of awareness messages, such as policy reminders, phishing alerts and changes to acceptable use, with the date each was sent and the audience. Clause 7.3 requires that people know the policy, their contribution to the ISMS and the effect of not conforming, so the content should cover those points over time. Check that the calendar and the sent-message logs agree.

Policy acknowledgment records

Retain signed or electronically recorded acknowledgments of the information security policy and the topic-specific policies that apply to each person. Include the version acknowledged, so an assessor can see whether staff accepted the current text after a revision. Check that leavers and new joiners since the last policy change are covered, and that contractors with ISMS duties are included where the organization relies on them.

Corrective training after incidents

When an incident traces back to a competence or awareness gap, record the corrective action, the people it reached and its completion date, then link the record to the incident and to the corrective action log. This is how clause 10.2 nonconformity handling meets clause 7.2 competence. Check a sample of closed incidents and confirm each one either has a training record or a documented reason why training was not the fix.

Sample pack for interviews

Prepare one pack per sampled role with the competence criteria, the person's training records, their policy acknowledgments and an example of awareness content they received. Auditors often interview staff from different roles and ask them about the policy in their own words. Test the pack by selecting five staff from different roles, confirming their records match the matrix, and rehearsing what each person can say about their duties.

How NIS2 and NIST CSF reuse the same competence and awareness records

The same competence and awareness records can serve ISO 27001, NIS2 and NIST CSF 2.0, but only if you map each framework's requirement to the records you already hold. The NIST CSF 2.0 Reference Tool lists informative references that connect PR.AT-01 and PR.AT-02 to clause 7.3 and to Annex A control 6.3, with PR.AT-02 also pointing to Annex A control 5.2. GV.RR-04 points to clause 7.3 and to Annex A controls 6.1 through 6.8, while GV.RR-03 points to clauses 7.1 and 7.2 and to Annex A control 6.6. On the EU side, ENISA's mapping table for its NIS2 technical implementation guidance (version 1.2, August 2025) links A.6.3 to points 8.1, 8.2 and 10.1 of the Annex to Implementing Regulation (EU) 2024/2690. Treat these as informative references that show where two frameworks touch the same subject, not as proof that satisfying one satisfies the other.

The practical decision is which artifacts you will treat as the single source. A training record that shows who completed which module, when, and against which role profile can support clause 7.2 (competence), clause 7.3 (awareness) and A.6.3 at once, provided it names the role, the content version and the completion date. Confirm each mapping against your own scope and records before you cite it in a regulator submission or a customer questionnaire. Check that the people, sites and business units in the scope statement appear in the training data, and that the wording you quote matches the control your records actually address. If a mapping cites a point or control you cannot evidence, say so rather than claiming coverage.

Keep the mapping itself under document control. Record the framework version, the reference you used and the date you reviewed it, and assign an owner who re-checks it when the NIST reference tool or ENISA table changes. Ask any implementation partner or auditor to confirm which mappings they accept for the evidence you propose, because an auditor issues the assessment conclusion and a regulator or customer decides what it accepts. Your own review is what makes the crosswalk defensible.

Questions buyers ask about ISO 27001 competence and awareness

Does ISO 27001 require a consultant to meet clauses 7.2 and 7.3?

No. Clause 7.2 (competence) and clause 7.3 (awareness) are obligations of the organization, and no standard requires an outside consultant. The organization must determine the competence its people need for work that affects its information security management system, make sure they have it, and keep records. It must also ensure relevant people know the information security policy, their contribution to the system and the consequences of not conforming. An implementation partner can design the competence matrix, draft the training plan and set up records, but the organization owns the decisions, the people who deliver the training and the evidence an auditor will sample. Certification itself is issued only by an independent certification body.

How much internal effort does ISO 27001 competence and awareness take?

The effort depends on the size of the organization, how many roles affect the management system, and how much training already exists. The main internal work is identifying the roles that need specific competence, defining what good performance looks like for each, collecting proof that people meet it, and running awareness communications on a regular cycle. Effort rises with the number of sites, contractors, teams with privileged access and frequent staff turnover. It falls when HR already tracks training and when role profiles are current. Ask any partner to break its quote into scoping, matrix design, content, deployment and evidence collection, and to state which tasks remain with your staff after handover.

Do we need a learning platform to meet clause 7.2 and 7.3?

No. ISO 27001 does not name a tool. A learning platform helps when you need to assign courses by role, track completion, time reminders and keep a dated record that an auditor can sample. A spreadsheet or HR system can meet the same need if the records are complete, controlled and retained. If you choose a self-hosted option such as Moodle, which is licensed under GPL-3.0-or-later, confirm that its activity completion settings match your evidence needs. Completion can be triggered when a learner views an activity, receives a grade, or ticks it manually, so the chosen condition should match what you can prove. Keep the platform inside your own infrastructure so training records stay under your control.

How is competence different from training under ISO 27001?

Training is one way to become competent. Clause 7.2 asks you to show that a person can perform the work that affects information security, which may come from education, prior experience, supervised practice or certification. Annex A control 6.3 covers the awareness, education and training program, including regular updates on policies and procedures. Clause 7.3 sets awareness outcomes for everyone in scope. An auditor may therefore accept evidence of experience for a senior engineer, but will still expect a training record or briefing for the wider staff. Map each role to its required competence first, then decide which training closes any gap.

What does an ISO 27001 auditor sample for competence and awareness?

Auditors usually sample a set of roles and individuals, then ask for proof that each person met the competence the organization defined. They typically request the competence matrix, role descriptions, training or qualification records, evidence of experience where it was used, and records of awareness communications. They also check whether people who joined recently, changed roles or work with privileged systems were handled correctly. Auditors often compare what staff say in interviews with what the records show. Keep records dated, attributable to a named person and easy to retrieve. The certification body decides the sample and the findings, so confirm the approach with it before the audit.

Can NIS2 and NIST CSF evidence be reused for ISO 27001 clauses 7.2 and 7.3?

Partly. The NIST CSF 2.0 Reference Tool maps PR.AT-01, PR.AT-02 and GV.RR-04 to clause 7.3, and GV.RR-03 to clauses 7.1 and 7.2, along with several Annex A controls. ENISA's mapping for NIS2 implementing guidance links A.6.3 to points 8.1, 8.2 and 10.1 of the Annex to Implementing Regulation (EU) 2024/2690. These mappings show where one body of evidence may serve several frameworks, but they are not equivalences. Confirm each mapping against the current source, and check whether the auditor or regulator accepts the same record for each purpose. Training records, role matrices and communication logs are the usual candidates for reuse.

What can an implementation partner deliver for competence and awareness, and what can it not?

A fixed-scope implementation partner can review existing role descriptions, draft a competence matrix, set up a training and awareness plan, configure a self-hosted learning environment inside your infrastructure, and prepare evidence templates and records for the auditor. DeployOpen plans, implements and documents systems in this way. It cannot decide your organization's competence requirements on your behalf, deliver staff training as a substitute for your own accountable owner, or issue an audit report or certificate. Agree the deliverables, responsibilities and acceptance criteria in writing before work starts, so it is clear which tasks belong to your team after handover.

How DeployOpen prepares competence and awareness evidence

DeployOpen works on the clause 7.2 and 7.3 evidence as part of a wider ISMS implementation inside the client's own infrastructure. We prepare the systems, learning records and documented evidence that show who is competent for their security roles and who has been made aware of the policy, while the organization owns the competence decisions and the independent certification body decides conformity.

How we scope

Agree in writing which roles, teams and interested parties are in the competence and awareness scope.
Map the required competence for each security role to the training, experience and records the organization already holds.
Confirm which learning platform, identity source and records system will hold the evidence before work starts.

How we build

Configure a self-hosted learning platform, such as Moodle under the GPL-3.0-or-later license, with course content tied to policies and roles.
Set activity completion rules so that completion records show what each learner viewed, was graded on or ticked off.
Test the record trail end to end, from role assignment through course completion to a retrievable report.

How we hand over

Deliver the competence matrix, awareness content, completion reports and procedure documents in formats the organization controls.
Document how records are versioned, retained and access-restricted, and who approves changes to training content.
Walk the internal owners through the evidence pack so they can answer an auditor's questions without us in the room.

How we support

Offer ongoing support, upgrades and content updates as a retainer when policies or roles change.
Review completion gaps and refresh awareness material as part of the organization's own review cycle.
Confirm with the certification body which evidence it expects, since it alone assesses conformity and issues the certificate.

ISO 27001 competence and awareness requirements (clauses 7.2 and 7.3)