A.6.3 Security awareness and training: requirements and evidence

What A.6.3 asks for and why auditors sample training records

When an auditor reviews A.6.3 Information security awareness, education and training, the first question is rarely whether you have a good training deck. The question is whether the right people were trained for their roles, and whether you can prove it. Control A.6.3 asks the organization to make sure personnel and relevant interested parties receive awareness, education and training suited to their job function, and to keep them updated on the information security policy and on topic-specific policies and procedures. In practice, that means a training program with two parts: role-appropriate content for different groups, such as engineers, finance staff, customer support and executives, and a steady cycle of updates when policies change. Untrained staff are one of the most common routes to avoidable incidents, from clicking a phishing link to mishandling customer data or sharing credentials, so the control exists because people are part of the security system.

The hard part is coverage, not content. An auditor will start from a population: the list of people in scope, typically drawn from HR records, identity directories and contractor registers. They will then sample individuals and check that each one has a completion record matching the training assigned to their role, dated after their start date and after the most recent policy revision. A single missing contractor or a team that joined after the last campaign can produce a finding even when the course itself is excellent. Before you build anything, confirm with your certification body how it expects the in-scope population to be defined, and reconcile your HR and identity sources so that the list of people who need training matches the list of people who actually have accounts and access.

Who counts as personnel in scope for security awareness training

A.6.3 applies to personnel and relevant interested parties, not only to employees on payroll. The populations you train are set by your ISMS scope, and the same scoping decision determines the population an auditor samples from when testing whether training reached everyone it should.

Employees across all functions

Permanent staff are the baseline population, and they must be covered in every business unit and location inside the ISMS scope. Check the HR system of record against the training platform, not a manual list, because gaps usually appear where people transferred between teams or joined through an acquisition. Ask whether leaders, board members and executives who approve access are included, since they often sit outside standard course assignments.

Contractors and temporary staff

Contractors, agency workers and interns often hold the same system access as employees but sit outside the HR record. Record each non-employee's start and end dates, sponsor and access scope so that training is assigned at onboarding and removed cleanly at offboarding. Confirm with your contract owner that training obligations are written into agreements, because an auditor will ask how you know a contractor completed the material.

Suppliers with system access

Relevant interested parties include suppliers and service providers that log in to your systems, handle your data or administer your environment. Decide whether they complete your course, their own equivalent training, or a documented briefing on your policies, and record which option applies to each vendor. This is the group most often missed, and it is where an auditor will probe whether the scope in your Statement of Applicability was applied consistently.

Role-specific content for high-privilege staff

Developers, system administrators and staff who manage privileged accounts need content that matches the decisions they make, such as secure coding, credential handling and change approval. Finance and customer support staff need content on invoice fraud, social engineering and customer data handling. Map each role to a content set and keep the mapping in a document an auditor can read, because role differences are what make training suited to job function.

Scope decisions that set the sample

The ISMS scope defines which people, systems and locations are in play, and an auditor builds the training sample from that population. A narrow scope that excludes a business unit removes its staff from the sampling frame, but it does not remove the risk. Document each inclusion and exclusion with its reason, and confirm the decision with your certification body before the audit, since the population you declare is the one you will be tested against.

How an assessor tests A.6.3 and which findings are common

This table compares what an assessor does to test A.6.3, the evidence they request for each step, and the findings that appear most often. Read each row as a test step, then check whether your own records would pass it without a manual explanation. The main takeaway is that an assessor needs a complete population, role-specific content and records tied to named individuals.

Test area	What the assessor does	Evidence requested	Common finding
Training program and role matrix	Reads the awareness program and maps each training module to job functions, such as developers, support staff, finance and contractors.	Written training program, role-to-module matrix, and the policies and topic-specific procedures the content is meant to cover.	No role differentiation, with one generic course given to everyone regardless of access or risk.
Population completeness	Obtains the list of personnel and relevant interested parties in scope, then compares it with the training records.	HR or identity directory export, contractor register, and the training platform roster for the same date.	Incomplete populations, where people with system access, such as contractors or part-time staff, are missing from the training list.
Sampling across roles	Selects individuals from several roles and checks whether each completed the training assigned to their function.	Completion records for sampled individuals, with dates, course versions and pass or attendance status.	Records cannot be tied to named individuals, for example shared logins, unnamed attendance sheets or group completions.
Updates after policy changes	Compares the dates of policy revisions with the dates content was updated and communicated to staff.	Change log for the policy, revised course materials, and the communication sent to personnel.	No evidence of policy-update communication, so staff completed training that no longer matches current policy.
New joiners and contractors	Tests whether training is completed before system access is granted, using a sample of recent starters and contractors.	Onboarding checklist, access provisioning timestamps and training completion dates for the same individuals.	Access granted before training is complete, with no documented exception or follow-up deadline.
Effectiveness and follow-up	Checks whether the organization reviews training results and acts on gaps, such as repeated phishing failures or missed modules.	Review minutes, remediation records for individuals who did not complete training, and management reporting.	Training is recorded as delivered, but no one reviews completion gaps or follows up on overdue individuals.

How to build a training program that passes A.6.3

This sequence turns A.6.3 from a policy statement into a training program with named owners, role-based content, tracked completion and recorded effectiveness reviews, the evidence an auditor samples to confirm that training reached everyone in scope.

Map roles and training needs
Start with the people in scope: employees, contractors and relevant interested parties. HR and the information security function list each job family, the systems and data each role touches, and the security responsibilities attached to it, such as privileged administration, customer data handling or software release. The output is a training needs matrix that maps each role to its required topics. Confirm the matrix with department heads and record who approved it and when. Auditors often start here, so the matrix should match the current organization chart and access records.
Define content for each role and topic
Build the curriculum from the matrix. Every role should receive the information security policy and relevant topic-specific policies, with general cyber hygiene content for all staff. Add targeted modules for common risk areas, such as malware and phishing awareness linked to A.8.7, and how to report suspected events under A.6.8. Engineers, administrators and managers receive additional role content. Each module needs a stated learning objective and a version number. The output is a content catalog that shows which module covers which policy clause and which role.
Set cadence and triggers for updates
Decide how often each module is delivered and what forces an earlier update. A.6.3 expects regular updates on policies and procedures, so the schedule should cover recurring refreshers plus event-driven triggers such as a policy revision, a significant incident, a new tool rollout or a change in regulation. Record the schedule in the training standard and name the owner who can trigger an off-cycle update. The output is an approved cadence document with trigger conditions that an auditor can compare against the policy change log.
Deploy the learning platform with completion tracking
Select or configure a learning management system or equivalent that assigns modules by role, records completion and holds the content versions delivered. Open-source options such as Moodle can do this when configured with role-based enrollment and completion rules. Confirm with the vendor that completion is recorded per learner and exported with timestamps, and that retired content versions are kept. Test the setup with a small pilot group before wide release. The output is a configured platform with a completion report that can be exported and retained as evidence.
Run and record the training
Assign modules to the people in the matrix, deliver them on the agreed schedule and chase overdue completions through the line manager. Record each assignment, completion, quiz result where used, and any exemption with the approver's name and reason. Reconcile the platform roster against HR and access records each period so that joiners, leavers and contractors are neither missed nor kept on the list. The output is a dated completion register that shows coverage against the matrix, which is the record an auditor samples to test that training reached everyone in scope.
Review effectiveness and close gaps
Review the program at planned intervals. Compare completion coverage with the matrix, examine results from phishing simulations or quizzes where they exist, and review security events, reports from A.6.8 and incidents for patterns that training should address. Record decisions in a review log: which modules to change, which roles need additional content and which gaps need an owner and a due date. Feed approved changes back into step two. The output is a signed review record with actions and their closure status, which shows the program is maintained rather than run once.

How completion tracking produces audit-ready evidence

Completion data is only useful as evidence if it shows who completed which training, when, and against which version of the policy content. A percentage on a dashboard does not satisfy A.6.3 on its own. An auditor will sample individuals in scope, ask for the record for each one, and check that the training they received matches the policy in force at that time. Where the policy changed after someone trained, the record should show that the person was brought up to date. Export the raw records (user, course or module, timestamp, version or revision, and result) rather than relying on a summary screen, and confirm that the platform keeps them for the retention period your audit cycle requires.

Learning platforms do not all mean the same thing by "complete." In Moodle, for example, activity completion marks an activity complete for a learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions the course designer set for that activity. A learner who opened a policy page and never acknowledged it may therefore show as complete, while another learner who passed a quiz may show the same status. The organization must decide which condition counts as training done for each piece of content, and that decision belongs in the training procedure, not in the configuration alone. Check the completion settings on every relevant activity, test them with a dummy learner, and confirm the result in the exported report before you rely on it.

Ask your implementation partner or internal platform owner to walk through three things before the audit: the completion conditions for each policy module, how a policy revision resets or reissues completion, and how records for leavers and role changes are kept. Each of these is a common point where evidence goes missing. If the platform cannot show the version of content each learner saw, decide whether to add a versioned acknowledgment step or to re-issue training after each material change. Whichever you choose, the independent certification body will test the setup and the records as they exist, so validate them with a sample of your own before the audit starts.

Which evidence satisfies A.6.3 and how to keep it current

An auditor testing A.6.3 wants to see that the right people received the right training, that the content matched current policy, and that the records can be traced to named individuals. The cards below cover the artifacts that carry that proof and the routine checks that keep them accurate between audits.

Training needs matrix by role

This matrix maps each job function, such as engineers, customer support, finance and contractors, to the awareness and training topics it requires. It shows why each group receives its content and is the first document an auditor reads to confirm that training is suited to job function. Review it when roles change, when a new system is adopted, and when the policy set is revised. Check that every role in the HR system appears in the matrix and that no role is left without an assigned course.

Course content with version history

Keep each course, slide deck, script and quiz under version control with dated revisions and the policy version it reflects. An auditor will compare the content against the current information security policy and topic-specific policies to confirm the training is up to date. Record who approved each revision. Confirm that retired courses remain archived so a past completion can be matched to the content the person actually saw.

Completion reports tied to named people

Completion records must identify each person, not just show a percentage. Export completion data from the learning platform with user identifiers, course version, completion date and score, then reconcile the list to the HR roster. Moodle, for example, can mark an activity complete when a learner views it, receives a grade or ticks it manually, so confirm which condition each course uses before reporting completion.

Policy update communications and acknowledgments

A.6.3 expects personnel to receive regular updates on the information security policy and related procedures. Keep the notice sent for each update, the date sent, the distribution list and each individual acknowledgment. Store acknowledgments with the policy version they refer to. A scheduled export that compares the distribution list with current active staff catches people who joined after an update and never received it.

Phishing and awareness campaign results

Where the organization runs simulated phishing or other awareness campaigns, keep the campaign design, target groups, dates, click and report rates, and the follow-up training assigned to those who failed. This evidence connects training to A.8.7 Protection against malware, which relies on user awareness. Auditors look for trends and corrective action, not only results. Confirm the platform's data retention settings so historical campaigns remain available for the audit period.

New-joiner and contractor training records

Staff who join mid-cycle and contractors with system access are the most common gaps in training evidence. Keep onboarding training records with the start date and the date of first access, so an auditor can confirm training happened before or shortly after access was granted. Reconcile contractor records against the access register, since contractors often sit outside the HR roster. Set a recurring check that flags any account without a completed course.

What meeting A.6.3 costs in money and staff time

This table breaks down the cost components of running A.6.3 awareness and training, who pays for each, whether it is one-time or recurring, and what pushes it up or down. Read the recurring rows as the ongoing budget, and use the drivers column to shape a quote request. No figures are given because none were supplied for this topic, so confirm amounts against your own headcount and role structure.

Cost component	One-time or recurring	What drives it up or down	Where open source changes the bill
Content development or licensing	One-time build, recurring refresh	Number of distinct roles, how often policies change, whether content is bought off the shelf or written in-house	Open-source course tools carry no license fee, but the organization still pays to write, localize and review the material
Learning platform setup	One-time	Integrations with the identity provider, custom courses, branding, testing across browsers and mobile devices	Moodle (GPL-3.0-or-later) removes the per-user license line, while setup, hardening and configuration remain a paid task
Learning platform hosting and support	Recurring	Hosting location, backup and patching frequency, number of learners, uptime expectations set in your own policy	Self-hosting moves spend to your cloud or data center account and to whoever operates the platform
Staff time to build role-based content	One-time, then recurring as roles change	Number of job families in scope, technical depth needed for engineers versus general staff, review cycles	Open tooling does not reduce the time HR, security and business leads spend deciding what each role must know
Staff time to run campaigns and track completion	Recurring	Headcount, contractor and third-party users, reminder cadence, number of policy updates in the year	Activity completion tracking can automate much of the status reporting, but someone still chases overdue learners
Evidence upkeep (rosters and records)	Recurring	Frequency of joiners and leavers, number of systems that hold identities, how often exports are reconciled	Reconciling exports from HR and the learning platform is an ongoing task whatever tool is used
Auditor sampling effort	Recurring per audit cycle	Sample size the auditor selects, how many records must be located quickly, quality of the roster and completion history	Clean, exportable records shorten sampling; confirm with your certification body how it samples

Who owns the training program, who helps build it, and what the auditor checks

Your organization owns the awareness, education and training program. A.6.3 expects personnel and relevant interested parties to receive training suited to their job function and regular updates on the information security policy and topic-specific policies. Those decisions belong to people inside the organization, because they must reflect the actual business risks, roles and tolerance for change. Ownership cannot be handed to an outside party, even when the build is outsourced.

Policy ownership: Set the training policy, define who is in scope, and decide how often updates are issued.
Role matrix: Map job functions such as developers, administrators, finance staff and managers to the modules each group must complete.
Content approval: Review and sign off every module against current policies before it goes live.
Completion follow-up: Chase overdue learners, record exceptions and escalate repeated non-completion through the disciplinary process.
Records retention: Keep dated approvals, rosters and completion exports that show the program ran as written.

Before the audit, confirm that a named owner can explain the role matrix and produce completion records for a sample of staff without help from a consultant.

Common gaps that fail A.6.3 and how to close them

Most A.6.3 findings are not about missing training content. They come from programs that were set up once and never maintained, with records that cannot prove who was trained, on which version of the policy and when. The cards below cover the gaps auditors find most often and a practical fix for each.

Training given once at onboarding

A new hire completes a course in their first week and is never asked again, even after policy revisions, new threats or a change of role. Auditors test whether training is ongoing, so the fix is a fixed refresh cycle set by the organization, with a trigger for off-cycle sessions when policies or threats change. Check that the refresh schedule is written in the awareness procedure and that completions exist for the most recent cycle, not only for onboarding.

One generic course for every role

A single course written for everyone rarely addresses what an engineer with production access, a finance approver or a customer support agent actually does with information. A.6.3 expects content suited to job function, so the fix is a short matrix that maps each role to the topics it needs, such as secure coding for developers and payment fraud for finance. Check that role assignments are recorded and that each role has a named module.

Completions tracked in an unreconciled spreadsheet

Completion lists kept by hand drift from the HR system, so leavers still appear as overdue and new joiners are missing entirely. An auditor sampling personnel will find the gap quickly. Export the active roster from the HR or identity system on a fixed schedule, compare it to the learning platform records, and keep the reconciliation as dated evidence. Where a learning platform such as Moodle is used, its activity completion settings determine what counts as complete, so confirm those conditions match the standard you claim.

No training after policy changes

Staff are expected to follow a policy revision that they never read or were never asked to acknowledge. A.6.3 explicitly calls for regular updates on the information security policy and topic-specific policies and procedures, so a revision without a communication step is a visible gap. Fix this by linking each policy version to a short briefing and a recorded acknowledgment, due within a defined period after publication. Check that the acknowledgment shows the version the person saw.

Contractors left out of the program

Contractors, temporary staff and some suppliers often hold system access comparable to employees but sit outside the HR roster, so they never enter the training process. Because A.6.3 extends to relevant interested parties, the scope has to be defined by access and role rather than employment type. Fix this by making training completion a condition of account provisioning for contractors, and by recording their completions in the same register as employees. Confirm the contractual terms cover the training obligation.

Records that cannot show content version

A completion record that says only that someone finished a course cannot show what they were taught. When the course was revised, an auditor cannot tell whether a person trained in 2024 saw the content that is current today. Store the content version, the date published and the completion date together, and keep superseded versions in the record archive. Check that you can produce, for any sampled person, the exact material they completed and the policy version it referenced.

Questions buyers ask about A.6.3 training cost, effort and outsourcing

How much effort does a small team need to meet A.6.3?

Effort depends less on headcount than on how many roles, policies and systems the training must cover. A small team needs to produce a baseline awareness course, short role-specific modules for engineers, support staff and anyone with privileged access, and a record of who completed what. The main drivers are the number of topic-specific policies that change, how often new joiners arrive, and whether the team already has a learning platform it can configure. Ask any partner to split its estimate into one-time content work and recurring administration, because the recurring part is what the team carries after handover.

Are self-hosted open-source learning tools acceptable evidence for A.6.3?

A self-hosted platform can produce acceptable evidence, provided it shows the content delivered, the audience, the dates and the completion results. Moodle, for example, has activity completion settings that mark an activity complete when a learner views it, receives a grade or ticks it manually, so the conditions you configure determine what the record proves. Confirm with your auditor which completion rule they expect, since viewing a page is weaker evidence than passing a short assessment. Keep exported completion reports, versioned course content and the access logs that show who controlled the course.

How often must information security training be repeated?

ISO/IEC 27001:2022 does not set a fixed frequency for A.6.3. It asks for awareness, education and training suited to each job function and for regular updates on the information security policy and related topic-specific policies and procedures. The organization sets the cadence and must justify it, usually by linking it to its risk assessment, the rate of policy change, staff turnover and recent incidents. A common design is an annual baseline with event-driven updates after a policy change or a significant incident. Document the cadence in the policy so an auditor can compare what you do with what you said you would do.

What does the training work need from staff?

Staff need time to complete the content, managers need to release that time, and named owners need to act on incomplete records. Engineers and administrators usually need role-specific material that uses their tools and real decision points, which takes more of their time than a general course. Someone in HR or the security team should own the completion report, chase overdue learners and record exceptions, such as staff on leave. Without that follow-up, completion rates drift and the records an auditor samples will show gaps.

Can a consultant write the awareness content for us?

A consultant or implementation partner can draft the content, but the organization must approve it and remain accountable for what it says. The content has to match your actual policies, tools and risk decisions, so the people who own those decisions should review each module. Ask the partner to show how each module traces back to a policy or procedure, and who signed off the final version. The partner's work is an input to your ISMS, not a substitute for it, and the training itself still belongs to the organization.

Will an auditor accept training records from a partner-run platform?

An auditor will test the records and the process behind them, not who hosts the platform. If a partner runs the learning system, the organization still owns the control, so it should hold admin rights or at least read access to exported records, and it should be able to show who approved the content. Agree in writing where the platform runs, who can change completion data, and how long records are retained. Auditors look for consistency between the course content, the audience list and the completion data, and they will sample individuals. Only the independent certification body decides whether the evidence is sufficient.

What should a quote for A.6.3 training include?

A useful quote lists each deliverable, the roles in scope, the policies the content must cover, the platform being configured, and the reporting the organization will receive. It should separate one-time work, such as content creation and platform setup, from recurring work, such as annual refreshes, new joiner handling and report reviews. Ask who is responsible for keeping records after the engagement ends and what happens to content when policies change. DeployOpen plans and implements these systems in the client's own environment and works from a written, fixed scope, so request that scope before comparing any prices.

How A.6.3 connects to malware protection and event reporting

Awareness training under A.6.3 is not only about the training itself. Two neighboring Annex A controls depend on people behaving correctly, and an auditor testing them will look for evidence that staff knew what to do. A.8.7 Protection against malware relies on user awareness, because technical scanning and endpoint tools catch only part of the threat that arrives through email, downloads and removable media. A.6.8 Information security event reporting relies on staff recognizing a suspected event and passing it to the right channel quickly. If the training content does not cover both, the organization has a gap that the technical controls cannot close.

In practice, the training plan should include modules on recognizing phishing and suspicious attachments, the steps to take when a device behaves oddly, and exactly how and to whom an event is reported, including the reporting address or form and what information to include. Completion records for these modules, along with the reporting procedure acknowledged by staff, are the awareness evidence an assessor can sample alongside the malware and event reporting records. Confirm with your certification body how it expects these links to be shown, since the scope of sampling is its decision.

Cross-references can help with planning but should not be treated as proof. NIST's crosswalk from SP 800-53 Rev. 5 relates A.6.3 to controls in the AT, CP, IR and PM families, and ENISA's mapping for NIS2 technical guidance links it to awareness, security training and human resources security points. NIST itself cautions that mapped controls are not always equivalent, so a mapping shows where to look, not what an auditor will accept. Use these tables to check coverage of obligations you already carry, then confirm the evidence requirements against the ISO/IEC 27001:2022 text and your own risk assessment. You can review the ENISA mapping table directly to see which NIS2 points are tied to A.6.3.

How DeployOpen prepares A.6.3 training systems and evidence

DeployOpen plans, builds and documents the training platform and records that A.6.3 Information security awareness, education and training depends on, inside the client's own infrastructure. The organization keeps ownership of its training content, policies and sign-off, and an independent auditor decides whether the control is met.

How we scope

Engagements are fixed-scope, with the training audiences, platforms and deliverables agreed in writing before work starts.
We confirm which roles, third parties and interested parties need role-based training and how often each group must receive policy updates.
The written scope names the records that will serve as evidence, such as completion logs, attendance exports and policy acknowledgment history.

How we build

We deploy a self-hosted learning platform in the client's cloud account, data center or air-gapped network, configured for role-based course paths.
We configure completion rules so a course is marked complete only under conditions the client has defined and documented.
We test completion reporting against a sample of users to confirm that records match the training the organization says it delivered.

How we hand over

We document the training process, owners, update cadence and how new joiners and role changes are enrolled, in a form the client can maintain.
We deliver an evidence map linking each training record type to the question an auditor is likely to ask about A.6.3.
We hand over administrative access and runbooks so the client's own staff can export records and run the platform after the engagement.

How we support

Ongoing support, upgrades and continuous testing of the training platform are available as retainers, agreed separately from the initial scope.
We can review completion reports and policy update records during an agreed period so gaps are found before an audit sample is drawn.
Preparation work is not an audit. Independent auditors and certification bodies issue any report or certificate for the organization.