Security awareness training for ISO 27001
ISO/IEC 27001:2022 expects staff awareness training under clauses 7.2 (Competence) and 7.3 (Awareness) and Annex A control 6.3 (Information security awareness, education and training). Our courses support the awareness training requirement of ISO 27001 (A.6.3) for all staff; competence for specific roles stays with you.
Key facts
| Standard | ISO/IEC 27001:2022 |
|---|---|
| Who it applies to | Any organisation audited against ISO 27001, in the UK, the US or anywhere else |
| Main training clauses | 7.2 Competence, 7.3 Awareness, Annex A 6.3 Information security awareness, education and training |
| How we describe our part | Supports the awareness training requirement of ISO 27001 (A.6.3) |
| Our library | A new UK and US library of finished courses (50 UK, 51 US) |
The text of ISO 27001 is sold, not free, so this page gives clause numbers and titles only, no quotes. The titles were checked on iso.org.
Clauses and the course topics that cover them
The UK and US edition is a new library made for UK and US teams: 40 story courses and 12 standards courses, 52 in all, all finished. Course names here are the names in that library; they have no course pages of their own yet.
| What it asks | Our course topics |
|---|---|
|
7.2 Competence |
The programme: every course assigned to all staff, with LMS records. Standards course: Security for Managers Competence for specific roles (security staff, developers, administrators) is yours. |
|
7.3 Awareness |
The programme: every course assigned to all staff, with LMS records. Standards course: Acceptable Use of Work Technology |
|
A.6.3 Information security awareness, education and training |
The programme: every course assigned to all staff, with LMS records. Standards course: Acceptable Use of Work Technology |
|
A.5.10 Acceptable use of information and other associated assets |
About it: Cloud Access Reviews; Work Profiles on Personal Phones Also: Fake Virus Warnings; Oversharing on Social Media; Hidden Data in Shared Files Standards course: Acceptable Use of Work Technology; Safe Use of AI Tools; Security Onboarding: Your First Week |
|
A.5.13 Labelling of information |
About it: Hidden Data in Shared Files Also: Sensitive Items in Plain Sight |
|
A.5.17 Authentication information |
About it: Storing Passwords Safely; MFA, Passkeys and Sign-In Alerts Also: Breach Notices and Stolen Data Standards course: Security Onboarding: Your First Week |
|
A.5.19 Information security in supplier relationships |
About it: Contractor Requests and Access |
|
A.6.8 Information security event reporting |
Also: Spotting Fake Emails; Stopping a Ransomware Attack; Website Outage Response; Secure Disposal of Documents; Resisting Bribes for Access; Safe Software Downloads Standards course: How to Report (and why no one is blamed); Security Onboarding: Your First Week |
|
A.7.7 Clear desk and clear screen |
About it: Sensitive Items in Plain Sight Also: Working in Public Places; Tailgating and Visitor Control |
|
A.8.1 User endpoint devices |
About it: Phone Repairs and Lost Devices; Work Profiles on Personal Phones Also: Installing System Updates Promptly; Working in Public Places |
|
A.5.4 Management responsibilities |
Standards course: Security for Managers |
|
A.6.2 Terms and conditions of employment |
Standards course: Security Onboarding: Your First Week The contract terms themselves are yours. |
|
A.6.4 Disciplinary process |
An HR process, not training: yours. |
When training must happen
We do not quote the standard's wording on timing. Set the timing in your own awareness programme, write it down and follow it. Our recommendation: when people join, then at least once a year, and again after a change that matters (a new policy, a new kind of scam).
What an auditor asks to see
Evidence for ISO 27001
- Who was trained, on which course, and when.
- Quiz results that show people understood (our pass mark is 80).
- Certificates for the people who passed.
- The training material itself (our course pages carry every transcript).
- Your programme document: topics, audiences and timing.
What our LMS gives you today
- Assignments: give courses to teams or people and see who finished.
- A scenario quiz after every course: 10 questions from a bank of 13 to 15, pass mark 80, a score for each learner.
- A certificate for every learner who passes.
- One space per client, and your own report method and security contact on the last screen of each course.
- The full transcript of every course on its course page, as a copy of the training material.
What stays your job
Our library is the all-staff awareness layer. These parts of ISO 27001 are yours:
- Competence for specific roles (7.2): security staff, developers, administrators.
- Contract terms (A.6.2) and the disciplinary process (A.6.4).
- Your information security policy, and a record that staff accepted it.
- Management responsibilities (A.5.4): our Security for Managers course helps, the duties stay yours.
Questions people ask
Which ISO 27001 control covers security awareness training?
Annex A control 6.3, Information security awareness, education and training, together with clauses 7.2 (Competence) and 7.3 (Awareness).
Do your courses cover the Annex A topics staff need to know?
Many of them: acceptable use, labelling, authentication information, suppliers, event reporting, clear desk and endpoint devices each have at least one course (see the table).
Is role-based training included?
No. Our library is the all-staff layer. Training for specific roles, such as security staff or developers, stays with you.
Sources
Last updated: 2026-10-16. This page explains how our training relates to ISO 27001; it is not legal advice.