6.3 Information security awareness, education and training

The organization's personnel and relevant interested parties are to receive information security awareness, education and training suited to their jobs, together with regular updates on the policy, topic-specific policies and procedures. Purpose: have staff and relevant outside parties know what security asks of them and do it. Guidance: build a programme aligned with the policies and procedures that reflects the information to be protected and the controls in place. It runs periodically, with initial sessions for new starters and for people moving into roles with substantially different security requirements, and understanding is tested at the end of each activity to check that knowledge transferred and the programme works. Awareness: aim to make people understand their responsibilities and how to meet them; plan by role, covering internal and external people such as consultants and supplier staff; schedule activities regularly so they repeat and reach newcomers; draw on incident lessons; and use varied physical or virtual channels (campaigns, booklets, posters, newsletters, websites, sessions, briefings, e-learning, email). Content covers management's commitment; the need to know and comply with applicable rules and obligations from policies, standards, laws, contracts and agreements; personal accountability for actions and omissions and the duty to protect the organization's and others' information; basic procedures such as reporting events (6.8) and baseline controls such as password security (5.17); and where to get further advice and material. Education and training: identify, prepare and deliver a training plan for technical teams that need particular skills to configure and maintain the required security of devices, systems, applications and services, and acquire any missing skills. Consider lectures, self-study, mentoring by experts or consultants, job rotation, hiring skilled people or consultants, delivered in classrooms, remotely, online or self-paced; technical staff keep current through publications, conferences and professional events. Other information: explain why, not only what and how, so people see how their behaviour helps or harms; the programme can be combined with other training such as privacy, ICT or safety.

Source: ISO/IEC 27002:2022, 6.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.