Training that changes behaviour, and leaves a record an auditor can follow

Most incidents start with an ordinary action: a reused password, an approved payment that should have been checked, a file shared to the wrong link. Control 6.3 exists so the people taking those actions recognise the risk in the moment. It sits in the people theme of Annex A next to screening, employment terms and the disciplinary process; the theme page covers those neighbours.

Do not confuse it with clause 7.2 (competence) and clause 7.3 (awareness) in the main body of the standard. The clauses require that people running the ISMS are competent and that everyone knows the policy and their part in it. Control 6.3 is how you deliver on both: the programme, the content and the proof. One well-run programme usually satisfies both, as long as the records show who was taught what.

Awareness

Everyone. Short, frequent, about recognising a risk and reporting it.

Training

Specific roles. Teaches a skill, such as reviewing access or handling a customer data request.

Education

A few people. Deeper learning, such as a certification for the security lead or secure coding for engineers.

Start from your risk assessment, not from a vendor catalogue. If a risk depends on human judgement, someone in a named role needs to be taught how to handle it. The table below is a starting map; adjust it to your own risks.

Contractors and temporary staff count when they handle in-scope information. Decide whether they take your programme or prove equivalent training from their employer, and write that choice down.

Simulated phishing is not required by Annex A. Many organisations use it because it turns awareness into something measurable. The number worth watching is the report rate: how many people flagged the message, and how quickly. A falling click rate on its own can just mean people learned what your test emails look like.

• Public shaming. Naming people who clicked teaches them to hide a real mistake, which is the opposite of what you want.
• Lures that cause harm. Fake bonus or layoff notices damage trust and can create employee relations problems.
• Testing without teaching. A click should lead to a short explanation on the spot, not just a line in a report.
• No report button. If people cannot report easily, you are only measuring who clicked.

• A training plan. Who gets which module and how often, linked to roles.
• Completion records. Name, module, date, and pass mark where there is one.
• Population match. The auditor picks names from the HR list, including recent joiners, and looks for each in your records.
• Content. The actual material, with a version date, so the auditor can see it was reviewed.
• Follow-up. What happened to people who were overdue.

Every programme has someone who never finishes. Write the escalation path into the policy before you need it: a reminder, then their manager, then a decision such as suspending access to sensitive systems until the module is done. Persistent refusal moves to the disciplinary process in control 6.4. An auditor accepts a short overdue list. They do not accept an overdue list nobody acted on.

Sources: ISO/IEC 27001:2022 (clauses 7.2 and 7.3, Annex A controls 6.3, 6.4 and 6.8, cited by number and name only); ISO/IEC 27002:2022 for the existence of guidance on control 6.3; NIST SP 800-50 on building a security awareness and training programme; NIST SP 800-53 Rev. 5, Awareness and Training (AT) family. Role mapping and examples are our own.