ISO 27001 Control 6.3: Information Security Awareness, Education and Training

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 6.3, information security awareness, education and training, requires everyone to receive training appropriate to their role and to keep it up to date. For a small business that means a basic awareness programme for all, role-specific training for people such as developers and administrators, and a record of who has had what.

If you want to guarantee that nobody complies with your policies, here is how. Put every one of them in everyone’s inbox first thing on a Monday morning, and ask them to read and accept. People will tick the boxes. They will not engage with the content, and they will not understand it. And what we really want is not a full set of ticks; it is people following the policies.

Control 6.3 asks for awareness, education and training that actually works. In my experience, two things separate training that works from the annual click-through: it is engaging, and it is consistent. A little, often, delivered in a way people do not mind watching, beats a lot, once, delivered in a way they endure.

This page covers what the control requires, the two approaches I have seen work best, and how to plan a year of awareness for a small business. There is a free training plan and record further down.

What control 6.3 actually asks for

The control requires personnel and relevant interested parties to receive appropriate information security awareness, education and training, and regular updates on the organisation’s policies and procedures, as relevant to their job. In practice:

• Awareness for everyone. The basics every person needs: recognising threats, protecting information, reporting problems.
• Training for specific roles. More depth for people whose jobs carry more risk: administrators, developers, finance, HR.
• Regular updates. Not just at induction. Ongoing, and whenever policies change.
• Relevant interested parties too. Contractors and others with access, not only employees.
• Evidence it happened. And, ideally, evidence that it worked.

In the 2013 edition this was control A.7.2.2. Clause 7.3 of the standard adds its own awareness requirements: people must know the policy, how they contribute to the ISMS, and what happens if they do not conform. Training under 6.3 is usually how you meet both.

What works: engaging content

The content I have seen work best is upbeat, and sometimes funny. Short videos with a bit of humour about phishing, tailgating or oversharing on social media get watched, remembered and talked about. Dry slide decks with a quiz at the end do not.

Budget limits what you can buy, but it does not limit how engaging you can be. Some ideas that cost little or nothing:

• The free NCSC Top Tips for Staff training, which is short, well made and designed for exactly this.
• Real examples from your own business. The phishing email that nearly worked last month is more memorable than any generic case study.
• Five minutes at the start of a team meeting, rather than an hour-long session.
• Asking someone who nearly fell for something to tell the story. People listen to colleagues.

What works: phishing simulations

The other approach I have seen work consistently is phishing simulation: realistic test emails sent to teams at random, with feedback for anyone who clicks. It keeps people on their toes in a way no amount of reading does, because the lesson arrives at the moment they make the mistake.

It needs handling with care. The NCSC’s phishing guidance is clear that simulations cannot teach people to spot every phish, and that punishing people who click is counter-productive and erodes trust. I agree. The point is learning, not catching people out. Do it well:

• Agree the approach with HR and management first, and tell staff that simulations will happen.
• Give immediate, friendly feedback to anyone who clicks: what they missed and what to look for next time.
• Celebrate reporting. The person who reports the test email is doing exactly what you want.
• Track trends, not individuals. Fewer clicks and more reports over a year is the measure.
• Never name and shame.

Combine simulations with technical controls. No training will stop every click, which is why email filtering, MFA and an easy way to report matter just as much.

Consistency: a little, often

The most common failure I see is not bad content. It is pace. Organisations push a heap of content at their people in a single go, usually just before an audit, and then nothing for the rest of the year. The messaging is never repeated, never reinforced and quickly forgotten.

Spread it out. One topic a month is enough for most small businesses. It keeps security in front of people, it gives each message time to land, and it produces a steady stream of evidence rather than one burst. Here is a plan that works for most small organisations:

Role-based training

On top of the monthly plan, some roles need more. Administrators need to understand privileged access and secure configuration. Developers need secure coding. Finance needs payment fraud and invoice redirection. HR needs screening and handling sensitive personal data. Identify those roles once, and record their extra training in the same place.

Policies, introduced not dumped

Introduce policies alongside the training that explains them. The acceptable use policy goes with the induction briefing; the remote working policy goes with the remote working session. When a policy changes, tell people what changed and why in a few lines, rather than re-sending the whole document.

What auditors will look for

For training, I ask for the record first and the course second.

1. A plan. What training happens, for whom and when? Is it ongoing, or once a year?
2. Records. Who completed what. I will pick a recent starter and a long-serving member of staff and look for both.
3. Role-based training. What extra training do administrators, developers and finance staff get?
4. Awareness in practice. I will ask people questions. Where is the security policy? How would you report a suspicious email? What happened the last time someone did?
5. Effectiveness. How do you know it is working? Phishing simulation trends and reporting rates are good answers.
6. Contractors. Do people working for you who are not employees get the training relevant to their access?

Common issues

• One annual e-learning module, completed the week before the audit.
• All policies sent at once for “read and accept”, with no explanation.
• No role-based training for administrators or developers.
• Phishing simulations used to catch and shame people, so nobody reports anything.
• No record of who has completed what.
• Contractors excluded from training entirely.
• Staff who cannot say how to report a suspicious email.

The self-check

Think about the last person who joined your team.

• What security topic did your staff hear about last month?
• If someone received a suspicious email right now, would they know how to report it?
• Is your click rate on phishing simulations going down, and your report rate going up?
• What extra training do your administrators and developers get?
• How were your policies introduced to the last person who joined?

What I see in audits

Honestly, this is a weak area for most teams I look at, especially small ones. People are expected to know what good looks like without anyone checking that they do. I have seen countless developers and infrastructure engineers who believe they have the skills to work securely, and the gap only shows when an external vulnerability assessment comes back, which can be sobering. Developers in particular are under pressure to ship quickly rather than securely, so the problem is usually a combination of knowledge and time.

What I recommend is a training matrix. Take a helicopter view of each role: what security knowledge should a developer have, or an infrastructure engineer, or a salesperson? Then run a mini gap analysis for each person, recording what they bring with them and what they still need. When clients look at me quizzically, I ask them to imagine someone joining next week. What do they need to know on day one? Do they need to read and understand your secure development principles? Training does not have to be a course. Experience people bring with them counts if it is recorded, and so do shadowing, reading and good videos, including free ones.

In my audits, only around a quarter of organisations have a solid training plan with records to match (see my findings). Size makes a big difference. In an organisation of 200 people there is usually an HR function with development processes, and my job is to unearth what already exists. In a team of three, it is unlikely anyone has given training serious thought, even if someone used AI the night before to generate a training policy. That is plain as day to an auditor: documentation with no substance in practice.

How control 6.3 links to other clauses and controls

• Clause 7.2, Competence, and clause 7.3, Awareness. The management system requirements that training under 6.3 usually satisfies.
• Control 5.1, Policies for information security. The policies people need to know about.
• Control 6.2, Terms and conditions of employment. Sets the obligation; training makes it understandable.
• Control 6.8, Information security event reporting. Every awareness programme should make reporting easy and expected.
• Control 5.36, Compliance with policies, rules and standards. When checks find people did not know a rule, training is the fix.

Frequently asked questions

Sources and further reading

Official legislation, standards and guidance referred to on this page.

• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• NCSC cyber security training for staff. Free short training from the National Cyber Security Centre.
• Phishing attacks: defending your organisation. NCSC guidance, including the limits of phishing simulations and why punishment backfires.
• Incident management. NCSC guidance, including making reporting easy for staff.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call