Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we show that the people running our ISMS are competent and that our staff are aware?

6 decision pointsThe pack behind this answer: ISO 27001 Implementation & Certification Readiness

Add to board memo

The short answer

Recommendation
Write competence requirements for each ISMS role, keep evidence that each holder meets them, and train every person in scope on joining and yearly. Include contractors, track completion, and test awareness with a few direct questions.
Reasoning
Auditors separate competence, the ability to do a security task, from awareness, knowing the policy, your part in it and what follows if it is ignored. Common findings are missing requirements for the ISMS manager, internal auditor or control owners, nothing for contractors, and no check that training worked. They also talk to staff, so records alone do not settle it.
Considerations
  • The standard's text is paywalled. The competence and awareness duties here come from public guides, so confirm what evidence your certification body accepts.
  • Competence applies to anyone who does work that affects information security, which includes contractors and outsourced staff.
  • Training courses for the ISMS manager or an internal auditor are optional. The standard asks for competence, not a particular certificate.
  • The 12-month interval is the pack's default. Higher-risk roles may need more.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartAuditors will ask how we know our people are competent and awareStepList the roles that affect information securityStepWrite the competence each role needsDecisionDoes each holder have evidence that they meet the requirement?StepClose the gap by training, hiring or contractingDecisionDid the action close the gap?DecisionAre contractors and temporary staff in the same records?StepAdd them to the same competence and training recordsStepRun awareness training at joining and at least every 12 monthsDecisionDo staff know where the policy is and how to report an incident?StepSend short, regular reminders and ask againStepKeep completion records for everyone in scopeDecisionDo managers see their own team's completion figures?StepGive managers the figures and make it part of their objectivesDecisionCan the sample answer after a second round?StepChange the training itselfOutcomeCompetence and awareness evidenced: keep the records current

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 17 steps.

  1. Start

    Auditors will ask how we know our people are competent and aware

    The standard treats competence and awareness separately. Competence is being able to do a security task. Awareness is knowing the policy, your own part in it and what follows if it is ignored. Both are tested by records and by talking to people.

    In the pack

  2. Step

    List the roles that affect information security

    Include the ISMS manager, the internal auditor, the control owners and anyone who runs a control, such as administrators, developers and finance. Add contractors and outsourced staff who do the same work. Assign each security task to a role so nothing falls between teams.

    In the pack

  3. Step

    Write the competence each role needs

    One short row per role: what the person must be able to do, and how it can be shown, by education, training or experience. The pack's checklist expects requirements for the ISMS manager, the internal auditor and the control owners. Auditors commonly expect a simple matrix.

    In the pack

  4. Decision

    Does each holder have evidence that they meet the requirement?

    Evidence can be HR or training platform records, certificates, CVs or appraisals, if they cover the ISMS roles including contractors. If a holder has no evidence, or you are not sure it exists, answer no.

    In the pack

  5. Step

    Close the gap by training, hiring or contracting

    Choose the quickest route that works: a course, mentoring, a hire, or a contracted specialist such as an internal auditor. Record the action, the owner and the date, and put it in the gap tracker if it blocks the plan.

    In the pack

    See also

  6. Decision

    Did the action close the gap?

    The pack lists a missing check that training worked as a common gap. Ask the person to do the task, review a piece of their work, or have a second person confirm, and keep a short note of the result. If you cannot show it worked, answer no and repeat the step above.

    In the pack

  7. Decision

    Are contractors and temporary staff in the same records?

    The pack lists missing contractor requirements as a common gap. Anyone who does work that affects information security needs the same competence and awareness evidence. If contractors are held elsewhere or not at all, answer no.

    In the pack

  8. Step

    Add them to the same competence and training records

    Ask the agency or supplier for their records, or put the contractor through your own induction and training. Check the contract for a security clause that refers to your policies.

    In the pack

  9. Step

    Run awareness training at joining and at least every 12 months

    Cover the policy, how each person's work helps the ISMS work, and what follows if the rules are ignored. Add extra training for higher-risk roles such as administrators, developers and finance, with short regular reminders. Training can start as soon as top management has approved the policy direction.

    In the pack

  10. Decision

    Do staff know where the policy is and how to report an incident?

    Auditors may ask staff directly, so ask a few yourself. An annual video with nothing else is a pattern the pack warns against. If you have not asked, answer no.

    In the pack

  11. Step

    Send short, regular reminders and ask again

    Use brief messages and, where it helps, phishing exercises with follow-up. Ask the same few questions again a few weeks later.

    In the pack

  12. Step

    Keep completion records for everyone in scope

    Keep the training plan, the completion records and any exercise results with their follow-up. Record who completed what, and chase the people who have not. A record without a name and a date proves little.

    In the pack

    See also

  13. Decision

    Do managers see their own team's completion figures?

    Managers need what they require to check their teams, such as training completion, and following the policies should be part of their responsibilities. If they never see the figures, answer no.

    In the pack

  14. Step

    Give managers the figures and make it part of their objectives

    Send each manager a short regular list of who has and has not completed training. Include security in their objectives so the chasing goes through the normal management line.

    In the pack

  15. Decision

    Can the sample answer after a second round?

    If most of the sample can now say where the policy is and how to report an incident, move on. If not, the reminders are not the problem. If you have not asked again, answer no.

    In the pack

  16. Step

    Change the training itself

    Shorten it, make it role-specific or move it into the induction and team meetings. Reminders alone will not fix a course nobody follows.

    In the pack

  17. Outcome

    Competence and awareness evidenced: keep the records current

    Keep the requirements, the evidence and the completion records up to date as people join, move and leave, and bring any gap that stays open to the management review.

    In the pack

Practical checklist

  1. List the roles that affect information security, including contractors.
  2. Write the competence each role needs, one row per role.
  3. Collect evidence of each holder meeting it from HR, training or appraisal records.
  4. Close any gap by training, hiring or contracting, and check that it worked.
  5. Run awareness training at joining and at least every 12 months, with extra for higher-risk roles.
  6. Track completion, chase it through managers, and ask a sample of staff what they know.

Evidence to have ready

  • Competence requirements for the ISMS manager, internal auditor and control owners.
  • Training records, certificates, CVs or appraisals that show each holder meets them.
  • The awareness training plan and completion records, including contractors.
  • Follow-up on any gap, with the check that the action worked.

Assumptions

  • The scope is approved, so you know who works within it.
  • HR or training records exist, or can be started, for staff and contractors in scope.
  • The 12-month awareness interval is the CISO Times pack's default. Your own procedure may set another.

Not covered here