Control 7.2Competence

Determine the competence necessary for the people doing work under the organisation’s control that affects information security performance; ensure those people are competent on the basis of appropriate education, training or experience; where applicable take actions to acquire the necessary competence and evaluate the effectiveness of those actions; and retain appropriate documented information as evidence of competence.

Competence is distinct from awareness in 7.3, and the distinction is the point. Awareness is what everyone needs; competence is what specific roles need in order to do specific work — the risk assessor, the internal auditor, the person who reviews access rights, the person who runs an incident.

The requirement to evaluate the effectiveness of training actions is the part most often missed. Attendance records evidence that training happened; they do not evidence that competence was acquired. The clause also reaches “persons doing work under the organisation’s control”, which includes contractors and, depending on the arrangement, supplier personnel.

How to put this in place

People who run the ISMS must be able to do the job. An unqualified internal auditor or control owner produces weak records, and auditors look for proof.

Define the competence each ISMS role needs, including internal auditors and risk owners.
Compare it with what each person has now.
Close gaps with training, coaching or contracted help.
Keep certificates, training records or appraisals.
Check that the training worked.

Evidence an auditor usually looks for: competence requirements per role and records showing each person meets them, including contractors.

What is in the packs for this

From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.

ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 4 (Implement and operate) of the implementation plan, which sets out the work and the gate that closes the phase.
Mandatory ISMS Documentation ChecklistExcel
Required Documents sheet, item MD-08: the typical form, what auditors accept instead and the gaps they reliably find.
ISMS Internal Audit Programme & ProcedureWord
Sets out the competence and independence records kept for internal auditors.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.