Control 7.3Awareness
Persons doing work under the organisation’s control must be aware of the information security policy, of their contribution to the effectiveness of the ISMS including the benefits of improved performance, and of the implications of not conforming with the ISMS requirements.
Three specific things, and the second is the one awareness programmes routinely leave out. Telling people the rules is not the same as telling them what their work contributes to, and a workforce that knows what is forbidden but not why the organisation cares produces exactly the compliance-shaped behaviour that fails under pressure.
The third element — the implications of not conforming — is where this clause meets A.6.4’s disciplinary process, and it has to be communicated before it can fairly be applied.
Awareness is also not an annual event. The clause states a condition people must be in, not an activity to perform, and evidence that the condition holds is what an auditor looks for.
How to put this in place
People in scope need to know the policy, their part in the ISMS and what follows if they do not comply. The project should start this early.
- Decide what everyone in scope must know about the policy, objectives and their contribution.
- Plan how it will be delivered, in induction and in regular reminders.
- Deliver it and record attendance.
- Test understanding by asking people.
- Repeat after policy changes and incidents.
Evidence an auditor usually looks for: the awareness plan, delivery records, and staff who can describe the policy and their role.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 4 (Implement and operate) of the implementation plan, which sets out the work and the gate that closes the phase.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.