ISO 27001 clauses
Clause 7 asks whether the people and means behind the ISMS are real.
A well-designed ISMS still fails if nobody has the time, skill or knowledge to run it. Clause 7 covers resources, competence, awareness, communication and the control of documented information. Auditors test it mostly by talking to people and sampling HR records.
Back to ISO 27001 services01 · Five parts
The five parts of clause 7
Four are covered here; documented information has its own guide.
- 7.1ResourcesDecide what the ISMS needs and provide it.
- 7.2CompetenceDefine the skills each ISMS role needs, close gaps, and keep proof.
- 7.3AwarenessEveryone in scope knows the policy, their part, and what happens if they ignore it.
- 7.4CommunicationDecide what is communicated about the ISMS, to whom, when and how.
- 7.5Documented informationCreating, approving, storing and controlling what you write down.
02 · Resources
Resources: show the decision, not only the spend
Auditors look for time and money allocated on purpose.
Resources include people's hours, budget, tools and outside help. The clause does not set an amount. It asks that you work out what is needed and provide it. The evidence is usually a line in a budget, a named percentage of someone's role, or a management review action that added capacity.
A warning sign for auditors is a risk treatment plan full of overdue actions with no resource decision anywhere. That reads as a resourcing gap, not a scheduling one.
03 · Competence
Competence: define it per role, then prove it
A competence matrix does most of the work in one table.
For each role that affects security, decide what the person must know or be able to do. Check people against it, act on gaps through training, mentoring or hiring, and check the action worked. The proof of competence is required documented information.
| Role (illustrative) | Competence needed | How it is gained | Evidence kept |
|---|---|---|---|
| ISMS lead | Running the risk process, the SoA and audits; knowledge of the standard | Lead implementer course or prior experience | Certificate or CV, objectives review |
| Internal auditor | Audit technique, independence from the area audited | Internal auditor course, shadowing | Course record, first audit reviewed |
| Cloud engineer | Secure configuration of the platform, access and logging | Provider training, peer review | Training record, review notes |
| Developer | Secure coding for the languages in use | Annual secure coding module | Completion record, code review samples |
| People lead | Screening, onboarding and exit steps | Briefing from the ISMS lead | Signed briefing note |
| Support agent | Verifying callers, handling customer data | Onboarding module, supervised tickets | Completion record, quality checks |
04 · Awareness and communication
Awareness is tested by asking people; communication needs a plan
Staff should be able to answer three questions without looking anything up.
- Where is the security policy, and what does it ask of me?. A plain answer, not a recital.
- How does my job help keep information safe?. Specific to the role: reviewing code, verifying callers, locking screens.
- What happens if I ignore the rules?. Both the harm to the business and the disciplinary process.
Training content and phishing exercises sit under the Annex A people control 6.3 Information security awareness, education and training, which has its own guide. Communication is simpler than it sounds: a table is enough.
| What | To whom | When | How | Owner |
|---|---|---|---|---|
| Policy changes | All staff in scope | On approval | Email and team channel | ISMS lead |
| Security objectives and status | Leadership | Quarterly | Leadership meeting | ISMS lead |
| Incident notices | Affected customers | As contracts and law require | Agreed contact route | Head of support |
| Certificate status | Customers and prospects | On issue and renewal | Trust page, sales team | Sales lead |
| Audit results | Leadership and owners | After each audit | Management review | ISMS lead |
05 · What auditors sample
What auditors sample under clause 7
A handful of people, their records, and one conversation each.
- Picks a few staff from the HR list, including a recent joiner, and asks for their competence and induction records.
- Asks one or two of them the awareness questions above, often informally during a walkthrough.
- Checks the internal auditor's competence and that they did not audit their own work.
- Compares the competence matrix with actual role holders, looking for roles with no defined requirement.
- Asks for evidence that one recorded gap was acted on and that the action was checked.
- Reads the communication plan and follows one entry to proof it happened.
06 · Small-company shortcuts
Shortcuts for a small company that still pass
Use systems you already run; avoid parallel paperwork.
Shortcuts that work
- Competence fields stored in the HR system, not a separate binder
- One onboarding deck that covers the policy, the three awareness questions and how to report an incident
- A single communication table inside the ISMS manual or wiki
- An external internal auditor for a small team that cannot stay independent
Shortcuts that fail
- One generic course for every role, including the ISMS lead
- Competence assumed from job titles with no record
- Awareness proved only by a click-through acknowledgement
- No evidence that a training gap was ever checked afterwards
Sources: ISO/IEC 27001:2022 clause numbers and titles (7.1 to 7.5); ISO/IEC 27002:2022 control name 6.3. Descriptions, the competence matrix and the communication plan are Auditify's own and illustrative.
Clause 7, answered
Does every employee need a competence record?
Those whose work affects security do; in practice that is most of them.
The clause covers people doing work that affects information security performance. In a software company that includes engineering, support and HR, so most staff end up in the matrix, often with light requirements.
Is a course certificate enough proof of competence?
It helps, but competence can also come from experience.
The standard accepts education, training or experience. A CV, a supervised first task or a reviewed piece of work can all serve as evidence, as long as it is kept and matches what the role needs.
How is awareness different from training?
Training is the activity; awareness is the result.
Clause 7.3 asks that people know certain things. Training is one way to get there. The auditor tests the outcome by asking staff, which is why a completed course alone does not settle it.
Do we need a separate communication procedure?
No. A simple plan in a table is common and accepted.
The clause asks you to decide the what, when, to whom and how of ISMS communication. A short table kept current, with evidence that entries happened, is usually all an auditor needs.
Make the people side of the ISMS as solid as the documents.
An ISO 27001 gap analysis checks your competence, awareness and communication evidence against what auditors sample.