ISO 27001 Security Awareness Training: Complete 2026 Guide

ISO 27001 security awareness training is not one requirement. It is three — clause 7.3, clause 7.2 and Annex A control 6.3 — and they cover three different groups of people, demand three different things, and only one of them obliges you to keep a record. Most companies buy a single annual e-learning course, tick the training box, and then lose marks at stage 2 because that course answered one of the three and ignored the other two.

This guide separates the three ISO 27001 security awareness training requirements, shows what each actually asks for, and lists the evidence an auditor will open. Every reference is to ISO/IEC 27001:2022 — edition 3, published October 2022, with the free climate-action Amendment 1:2024 attached. You can check the current edition and amendment status on ISO’s own catalog page before quoting clause numbers out of an older implementation manual.

Where ISO 27001 security awareness training lives in the standard

Clauses 7.2 and 7.3 sit in the management system requirements, clauses 4 to 10. Those are mandatory in full. There is no mechanism for excluding them, scoping around them, or deciding they do not apply to your business model.

Annex A control 6.3 is different. Annex A is a reference set of 93 controls in four themes, and each is assessed for applicability in your Statement of Applicability, which clause 6.1.3 makes mandatory. In theory you could exclude 6.3 with a written justification. In practice nobody does, and an auditor who saw it excluded would spend the rest of the day on your risk assessment.

So all three apply to almost every certified organization, and they stack rather than overlap:

Requirement	Who it covers	What it demands	Record required by the text?
Clause 7.3 Awareness	Persons doing work under the organization’s control — employees, contractors, temps, volunteers	Awareness of three specific things (below)	No explicit documented information requirement
Clause 7.2 Competence	Only persons whose work affects information security performance	Determine the competence needed, ensure it, act to close gaps, evaluate whether the action worked	Yes — retain documented information as evidence of competence
Annex A 6.3	Personnel and relevant interested parties	Awareness, education and training plus regular updates on the policy, topic-specific policies and procedures, as relevant for the job function	Not stated in the control; expected in practice as program evidence

Read the last column again. Of the three ISO 27001 security awareness training requirements, clause 7.2 is the only one that uses the phrase “retain documented information”. That single difference decides what you can argue your way out of and what you cannot.

Clause 7.3 is the floor, not the program

Clause 7.3 asks that persons doing work under the organization’s control be aware of three things, and only three:

• the information security policy;
• their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance;
• the implications of not conforming with ISMS requirements.

That is the floor for ISO 27001 security awareness training, and it is a low bar. An induction deck plus a signed policy acknowledgement covers it for most of a workforce. Two points are routinely missed.

First, the second bullet is about contribution and benefit, not rules. A deck that lists ten prohibitions and never explains why the ISMS exists or what good performance buys the business does not satisfy it. Auditors test this by asking a random employee what the ISMS is for. “Something to do with the security team” is a finding.

Second, “persons doing work under the organization’s control” already reaches past your payroll. Contractors, agency staff, interns and outsourced helpdesk agents inside your scope are in. If your awareness platform only has seats for employees, clause 7.3 is a gap before you even reach Annex A.

Clause 7.2 is the part of ISO 27001 security awareness training that leaves a record

Clause 7.2 has four lettered parts. The organization has to determine the competence necessary for people whose work affects information security performance; ensure those people are competent on the basis of education, training or experience; where applicable take action to acquire the competence and evaluate the effectiveness of the action taken; and retain appropriate documented information as evidence of competence.

The population is narrower and the bar is higher. This slice of ISO 27001 security awareness training is not about everybody. It is about the risk owners, the internal auditors, the incident responders, the administrators with privileged access, the person who maintains the risk register. For those roles, a completion certificate for a generic 30-minute course proves attendance, not competence.

Education, training and experience are alternatives. You do not have to train a twenty-year network engineer to prove competence in firewall rule review — a CV, a qualification and a role description can carry it. Plenty of organizations build training they do not need because they read 7.2 as a training clause. It is not.

You have to evaluate whether the action worked. Part (c) asks you to evaluate the effectiveness of the actions taken, and it is the most common omission in the clause. A training record proves delivery; effectiveness needs something after delivery — a pass mark, a supervised task, a reviewed output, a re-assessment at the next appraisal. Our guide to security awareness training metrics works through reach, behavior and outcome measures and what targets are realistic for each.

What Annex A control 6.3 adds that the clauses do not

Control 6.3 is the people control that turns ISO 27001 security awareness training into a program. It carries forward the substance of A.7.2.2 from the 2013 edition, restructured and given a stated purpose. Its three operative words — awareness, education and training — are not synonyms. Awareness is knowing that information security applies to you. Education is understanding why the rules are the shape they are. Training is being able to carry out a specific task correctly. The same continuum underpinned NIST’s SP 800-16, which NIST folded into SP 800-50 Revision 1, published September 2024.

It reaches relevant interested parties

The control covers personnel and relevant interested parties — a wider circle than “under the organization’s control”. It can pull in suppliers, service partners, and in some scopes customers who handle your information. You are not obliged to put your supply chain through your LMS, but you are obliged to decide which external parties are relevant and make sure those that are receive something appropriate — usually security expectations in supplier onboarding plus a documented decision about who was in and who was out. An empty answer here is a finding, because the control names the group explicitly.

It is keyed to the job function, not the calendar

The control asks for updates on the information security policy, topic-specific policies and procedures as relevant for the job function. Two consequences, and together they are why one annual course fails.

ISO 27001 security awareness training content has to differ by role. Developers need secure development and change control. Finance needs payment fraud and supplier verification. Administrators need privileged access and logging. A single deck delivered to everyone is demonstrably not “as relevant for their job function”, and an auditor can show that in a minute by comparing your course outline to your topic-specific policy list.

The update has to follow the policy, not the year. Regular updates on policies and procedures means that when you revise the acceptable use policy in March, the people it binds hear about it in March. Very few organizations have any mechanism connecting a document revision to a communication, which is why this gap surfaces when awareness and ISO 27001 document control are audited together. If your document control procedure has an approval step and a distribution step but no “notify affected roles” step, you have found your corrective action.

How often ISO 27001 security awareness training must happen

Here is the fact that surprises people: ISO/IEC 27001:2022 states no frequency anywhere. There is no annual requirement in clause 7.2, in clause 7.3, or in control 6.3. The guidance in ISO/IEC 27002:2022 says awareness, education and training should take place periodically, and that initial training applies to new personnel and to people moving into roles with substantially different security requirements. “Periodically” is as specific as it gets.

So you set the ISO 27001 security awareness training interval yourself, then defend it against your own risk assessment. Four triggers cover almost every certified organization, and an auditor will look for all four rather than for a number:

Trigger	Who	Typical practice
On hire	All new starters, including contractors in scope	Before or within days of system access; provisioning gated on completion
On role change	Anyone moving to a role with different security requirements	Delta training on the new role’s topic-specific policies
On policy change	The roles the revised document binds	Targeted notification plus acknowledgement, released with the document
Periodic refresh	Everyone, with role modules layered on	Commonly every 12 months; higher-risk roles often every 6

Twelve months is the convention, not the rule. If your risk assessment names phishing as a top risk and your refresher cycle is annual with nothing in between, expect to be asked why.

Building an ISO 27001 security awareness training program that survives stage 2

A defensible program is a common baseline for everyone plus role modules on top, with one matrix showing who gets what and why. Build the matrix from your topic-specific policy list rather than your training vendor’s catalog — that way every module traces to a document, and every document that binds a role traces to a module.

Audience	Covers	Maps to
Everyone (baseline)	Policy, why the ISMS exists, consequences of non-conformity, incident reporting, phishing, clear desk, acceptable use, classification	Clause 7.3, control 6.3
New starters	Baseline at or before system access, plus terms of employment and confidentiality obligations	Controls 6.2, 6.3, 6.6
Developers and engineers	Secure development policy, secure coding, change management, test data handling	Control 6.3, controls 8.25 to 8.33
Administrators and privileged users	Privileged access, logging and monitoring, configuration management, key handling	Clause 7.2, controls 8.2 to 8.9
ISMS role holders	Risk assessment method, internal auditing, nonconformity and corrective action	Clause 7.2 — competence evidence required
Executives and management review	Leadership obligations, review inputs, resourcing decisions	Clauses 5.1, 7.2, 9.3
Relevant interested parties	Security expectations in contracts, incident notification routes, handling rules	Control 6.3, controls 5.19 to 5.22

If you are building the ISMS from scratch rather than retrofitting ISO 27001 security awareness training onto one, sequencing matters: competence and awareness are clause 7 obligations you can only size once the scope, the risk assessment and the Statement of Applicability exist. Our ISO 27001 implementation guide sets out that order and where clause 7 falls in it.

The evidence an ISO 27001 security awareness training audit will open

Auditors sample. They will not read your whole LMS; they pick four or five people across different roles and follow each one end to end. Have these ready, tied to the same employee list your HR system uses:

• The program document — audience, content, triggers, frequency, owner, and the link from each module to the policy it teaches.
• Completion records with dates, by person, including contractors and the induction cohort.
• Policy acknowledgements — who accepted which version of the policy and when, the cleanest way to evidence the first bullet of clause 7.3.
• Competence evidence for ISMS role holders — role descriptions with competence criteria, plus the CVs, qualifications, assessments or auditor training that satisfy them. This is the mandatory record, and it appears in our list of ISO 27001 mandatory documents as evidence of competence and training.
• Effectiveness evidence — quiz scores, phishing simulation results, re-assessment outcomes, or a management review paper that draws a conclusion from them. Delivery data alone does not meet clause 7.2(c).
• Change-triggered communications — the notification that went out with your last policy revision, and the acknowledgements it collected.
• The interested-parties decision — which external parties were judged relevant for control 6.3, what they receive, and the justification for anyone excluded.

Five findings that come up again and again

These are the recurring weak points in ISO 27001 security awareness training, in rough order of how often they are written up.

1. One course for everybody. Fails the “as relevant for their job function” test in control 6.3. Split the baseline from role modules and publish the matrix.
2. No competence evidence for ISMS roles. The internal auditor has no auditor training on file, or the risk owner has nothing showing they understand the method. A clause 7.2(d) nonconformity, and the hardest to argue down, because the clause names the record.
3. Delivery measured, effectiveness not. A 98% completion dashboard and no answer to “did it change anything?” Clause 7.2(c) asks the second question.
4. Contractors outside the system. In scope for clause 7.3, invisible to the LMS — usually a licensing decision nobody revisited.
5. Policy revisions nobody announces. The document gets a new version number and an approval signature, and the people it binds never find out.

ISO 27001 security awareness training FAQ

Does ISO 27001 require annual security awareness training?

No. ISO/IEC 27001:2022 sets no interval. ISO/IEC 27002:2022 guidance says periodically, with initial training for new personnel and for people moving to roles with substantially different requirements. Annual is the common convention and a defensible default, but it is a decision you justify from your risk assessment, not a requirement you inherit.

Is a training record a mandatory document under ISO 27001?

Evidence of competence is mandatory, under clause 7.2(d). A general awareness completion log is not named in the standard, but it is the normal way to demonstrate clause 7.3 and control 6.3 and you will be asked for it. A missing competence record for an ISMS role holder is a clear nonconformity; a gap in awareness logging is usually argued on the strength of the alternative evidence you can produce.

Do contractors and suppliers need ISO 27001 security awareness training?

Contractors working under your control fall under clause 7.3 and belong in your program on the same basis as employees. Suppliers are a separate question: control 6.3 covers relevant interested parties, so you decide which external parties are relevant and provide something appropriate — often security requirements in the contract plus a short briefing — and record the decision either way.

Does an off-the-shelf e-learning course satisfy Annex A 6.3?

It can satisfy the baseline layer, not the control on its own, because 6.3 is keyed to your policy, your topic-specific policies and your procedures, and a generic course does not teach your documents. Keep the vendor course as the baseline and add a short internal module per role that walks through the policies that role has to follow.

What is the difference between awareness, education and training in control 6.3?

Awareness is knowing information security applies to you and what to do when something looks wrong. Education is understanding the reasoning — why classification exists, why least privilege is the default. Training is the ability to carry out a defined task to a standard, such as triaging an incident or reviewing an access list. Control 6.3 names all three, so a program made entirely of awareness posters is incomplete.

Where to start

To tighten existing ISO 27001 security awareness training, run the cheap diagnostic first. List your topic-specific policies in one column and your training modules in the next; rows with a policy and no module are your content gap. Then pull the role descriptions for your internal auditor, risk owners and administrators and check that a competence criterion and a piece of evidence exist for each. Those two checks find most of what a stage 2 auditor would, before it costs you a nonconformity.

Our ISO 27001 Toolkit provides 165 templates mapped to ISO/IEC 27001:2022, including the competence and training records, role descriptions with competence criteria, the awareness program documentation and the full Annex A control set that ISO 27001 security awareness training has to teach. It is $99 as a one-time purchase, in editable Microsoft Office format with example text marked up so you can see what belongs in each field.