Information security awareness, education and training

What the control asks

The organization's personnel and relevant interested parties are to receive information security awareness, education and training suited to their jobs, together with regular updates on the policy, topic-specific policies and procedures. Purpose: have staff and relevant outside parties know what security asks of them and do it. Guidance: build a programme aligned with the policies and procedures that reflects the information to be protected and the controls in place. It runs periodically, with initial sessions for new starters and for people moving into roles with substantially different security requirements, and understanding is tested at the end of each activity to check that knowledge transferred and the programme works. Awareness: aim to make people understand their responsibilities and how to meet them; plan by role, covering internal and external people such as consultants and supplier staff; schedule activities regularly so they repeat and reach newcomers; draw on incident lessons; and use varied physical or virtual channels (campaigns, booklets, posters, newsletters, websites, sessions, briefings, e-learning, email). Content covers management's commitment; the need to know and comply with applicable rules and obligations from policies, standards, laws, contracts and agreements; personal accountability for actions and omissions and the duty to protect the organization's and others' information; basic procedures such as reporting events (6.8) and baseline controls such as password security (5.17); and where to get further advice and material. Education and training: identify, prepare and deliver a training plan for technical teams that need particular skills to configure and maintain the required security of devices, systems, applications and services, and acquire any missing skills. Consider lectures, self-study, mentoring by experts or consultants, job rotation, hiring skilled people or consultants, delivered in classrooms, remotely, online or self-paced; technical staff keep current through publications, conferences and professional events. Other information: explain why, not only what and how, so people see how their behaviour helps or harms; the programme can be combined with other training such as privacy, ICT or safety.

Purpose in the standard’s terms, in our words: Makes staff and relevant outside parties know and carry out their security duties.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Human resource security; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• A documented awareness, education and training programme aligned with the policies and planned by role, including external personnel
• Completion records for initial training of new starters and role changers and for periodic refreshers
• Assessment results testing understanding at the end of training activities
• Awareness materials across channels covering management commitment, obligations, accountability, event reporting and baseline controls
• A training plan for technical teams with identified skill gaps and actions taken to close them
• Evidence that incident lessons were fed into awareness content

Where audits commonly find gaps

• Training is a single annual click-through with no test of understanding
• Contractors and supplier staff are excluded from the programme
• Technical teams receive no specialist security training for the systems they manage
• Content is generic and never updated after incidents or policy changes

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (07.2.2) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 6.1 Screening
• 6.2 Terms and conditions of employment
• 6.4 Disciplinary process

Read the five attributes All 93 controls