Control A.6.3Information security awareness, education and training
Personnel of the organisation and, where relevant, interested parties must receive appropriate information security awareness, education and training and regular updates of the organisation’s policies and topic-specific policies, as relevant for their job function.
Three distinct things. Awareness is knowing that security matters and what to do; education is understanding why; training is being able to perform a specific task. A programme that delivers only the first is the most common shape, and it is also the least effective, because it tells people to be careful without giving them anything to be careful with.
“As relevant for their job function” is the requirement to differentiate. Developers, administrators, finance staff and executives face different risks, and a single annual module serves none of them well.
The measure of effectiveness is behaviour rather than completion. Reporting rates under A.6.8 are usually a better indicator than test scores — an organisation whose people report more suspicious events after training has changed something real.
How to put this in place
Most incidents begin with a person, so a project needs awareness and training that people actually complete and that fits their role. One annual video that nobody chases is the usual weak point.
- Decide what everyone must know, and what extra training administrators, developers, finance and managers need.
- Write a short training plan with frequency, at joining and at least yearly, and the owner.
- Deliver it, adding short reminders and phishing exercises between sessions.
- Record who completed what, chase the gaps, and check that training changed behaviour.
- Review content after incidents and each year.
Evidence an auditor usually looks for: the training plan, completion records for all in-scope people including new joiners, and follow-up from phishing exercises or incidents.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists records of awareness and training completed among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.