A.6.3 Information security awareness, education and training
Give personnel and relevant parties appropriate, current security training for their role.
16
artefacts
2
held by a system
6
at each review
hard
to go live
HR system / LMS
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Learning Management System Export for Specific Role · Identity provider / directory
- Phishing Simulation Metrics Before and After Training · Endpoint management (MDM / EDR)
periodic reviewEvidence produced at each review
- Annual Information Security Training Calendar · HR system / LMS
- Record of Mandatory Training Assignments · Identity provider / directory
- Signed Attendance Sheets for In-Person Sessions · SIEM / log platform
- Webinar Attendance Report · SIEM / log platform
- Employee Feedback Survey Results · HR system / LMS
- Management Review of Training KPI Dashboard · HR system / LMS
governing documentDocuments that govern the control
- Training Needs Analysis Document · HR system / LMS
- Curriculum Outline for Security Awareness · HR system / LMS
- Approved Training Budget · HR system / LMS
- Job Role Matrix with Assigned Security Training Modules · Policy repository / GRC workspace
- Individual Training Completion Certificates · Policy repository / GRC workspace
- LMS Login and Completion Timestamps · Policy repository / GRC workspace
- Training Session Sign-in Sheet · Policy repository / GRC workspace
- Post-Training Quiz Results Summary · HR system / LMS
First move
Mostly documents and reviews. Pull the 2 system-held artefacts from your Identity provider / directory on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Training not aligned to specific job functions
- Content not updated on a regular basis
- Missing or incomplete attendance documentation
- No systematic measurement of training impact
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.6.2 Terms and conditions of employment · A.6.4 Disciplinary process