Skip to main content
All measures

Measure · ISO 27001 and other standards

Plan training and check understanding

Connect current rules to the work of each target group. Plan periodic and event-driven communication and use a work scenario to check whether people understand it.

Accountable: Training lead with line managersReviewed

Reuse existing records

Use the existing onboarding or training plan and current rules. Keep the record structure in an existing spreadsheet, meeting record or learning system.

What to do

  1. 1

    Assign content and target groups

    Determine the knowledge each role needs from its duties and risks. Use current rules for information handling, authentication, reporting and relevant approvals. Add necessary specialist knowledge, such as development or administration skills. In the existing plan, record the target group, content and policy version, instructor, format, repetition and relevant triggers such as joining or a role change. Compare required competence with existing education, training and experience. Address gaps through suitable learning, mentoring or another appropriate personnel action. Explain the information security policy, each person's contribution to an effective ISMS, including the benefits of improved security performance, and the implications of nonconformity.

  2. 2

    Deliver training and check understanding with a case

    Explain rules through typical tasks. Use suitable questions or a short exercise, such as responding to a suspicious call. Record the date, people reached, version covered and result in the existing record. Clarify wrong answers and available contacts; follow up on missing training.

  3. 3

    Evaluate the effect and update content

    Check whether the target group can apply the intended workflow. Use question results, suitable observations and lessons from incidents. Revise unclear content and check the follow-up. Repeat at your risk-based interval and when relevant changes occur. Retain suitable evidence of existing and acquired competence in the existing personnel or training record.

Worked example

A caller requests a login code

Fictional example: During onboarding, a team learns how to respond to an alleged IT support call.

Apply the rule
DecisionThe person does not disclose the code, ends the unclear request and uses the known enquiry or reporting channel. Unclear answers are discussed together.
EvidenceExisting training record with date, target group, policy version, scenario question and follow-up result.

Record the result

  • Existing training plan with target groups, role-specific content, responsibility and repeat triggers.
  • Traceable delivery, suitable understanding checks and resolved knowledge gaps in the existing record.

Common implementation mistakes

Treating acknowledgement as learning

Use a suitable question or activity to check whether the person can apply the content.

Setting a fixed pass rate as an ISO requirement

Choose an effectiveness check based on risk and target group; the standard does not set a universal pass rate.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards
  • A.6.3 · Informationssicherheitsbewusstsein, -ausbildung und -schulungGerman guide

    The steps connect role-based and risk-based learning with repetition, understanding checks and evaluation of the effect. The organisation determines actual content, competence needs and delivery.

  • TISAX · 2.1.3

    VDA ISA 6.0.3 · Partial overlap

    Role-based planning, periodic and event-driven learning, participation and understanding checks contribute to the awareness and training programme. All applicable ISA content, management approval and actual delivery remain to be ensured separately.

    Reference

  • ISO/IEC 27001 · 7.2

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Required competence is compared with education, training and experience. Suitable actions address gaps, their effectiveness is evaluated and appropriate evidence of competence remains in the existing record.

    Reference

  • ISO/IEC 27001 · 7.3

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Learning covers the information security policy, personal contribution and benefits of an effective ISMS, and implications of nonconformity. Suitable work scenarios check understanding.

    Reference

Templates for your implementation

Related resources

Sources and further reading