ISO 27001 Annex A 6.3: security awareness training that passes audit

The register says every employee finished the security video. Then the auditor asks a new starter how to report a suspicious email, and she can't say. That gap is where ISO 27001 Annex A 6.3 findings come from.

This guide is for security leads, compliance managers and operations directors at 25–250-person UK firms heading for certification. It covers what the control requires, how to build the programme, how to evidence it and how auditors sample and grade it.

What does A.6.3 information security awareness, education and training require?

ISO 27001 A.6.3 requires a running programme, not an annual video. Everyone working under your direction gets baseline security training at joining and on a regular cycle, deeper training where their role demands it, and a check that the message landed. Consultants and supplier staff are included where their work touches your information.

Policies only work if the people they bind know what they say, why they exist and what to do when something looks wrong. A compliant programme therefore has four parts:

• Baseline for everyone: the rules that bind them, where the policies live, password and MFA hygiene, spotting social engineering and reporting something suspicious.
• Depth for risky roles: extra training where the job carries extra exposure.
• Refresh over time: a repeat at least yearly, plus a re-brief when someone moves into a role with very different risks.
• A check that it landed: evidence of understanding, because attendance does not prove it.

The control is preventive. Trained people spot the phishing email, question the odd payment request and lock the screen, so the incident never happens. Because human error can breach confidentiality, integrity or availability, the control touches all three.

How does ISO 27001 Annex A 6.3 relate to clauses 7.2, 7.3 and A.6.8?

Annex A 6.3 information security awareness, education and training is the delivery machinery for Clause 7.2 (competence) and Clause 7.3 (awareness). Auditors sample the same evidence from both directions. One of the programme's core payloads is the reporting route that A.6.8 requires, so staff know how to raise a suspicious event.

The management-system clauses set the bar, and the Annex A control is how you clear it. An auditor working through the clauses asks whether people are competent and aware. One working through Annex A asks how you trained them. Both end up at the same register.

Treat the overlap as a design rule:

• One plan and one owner. A single training plan and owner procedure answers both lines of questioning.
• One register. The same completion records evidence competence and awareness, so there is nothing to reconcile.
• The reporting route as a core payload. It is the answer staff most often have to give in interview, so teach it at induction and repeat it in every reminder.
• One review. Put training effectiveness on the management-review agenda, where both clauses will look for it.

Why does the human layer matter for a 25–250-person firm?

Most incidents at 25–250-person firms start with a person: an invoice-redirection email to finance, a credential phished from an unbriefed new starter, a developer who never learned what an injection flaw looks like. Enterprise buyers ask about training in every due-diligence pack, and the ICO expects initial and refresher training for staff handling personal data.

The direct losses are real money, since payment-fraud scams routinely clear five and six figures. The indirect cost is trust: a buyer who finds no programme reads it as a supplier that hasn't thought about its people, and insurers price training into premiums.

The regulator expects it too. The ICO guide to data security under UK GDPR says staff should receive appropriate initial and refresher training, and the security principle in Article 5(1)(f) is why that advice carries weight. Our guidance is to treat the training register as a sales document as much as an audit one. It answers the due-diligence question before the buyer chases it.

Training is also the cheapest control you own relative to what it prevents. It needs no new infrastructure, and most of the effort goes into writing the plan and keeping the register honest.

How do you implement A.6.3 step by step?

Write a one-page plan naming an owner, give everyone baseline training at induction before system access is switched on, refresh at least yearly, and keep a cheap drumbeat of tips between sessions. Record every completion in one register. Standing this up takes one to two weeks with off-the-shelf content.

This is the sequence we would give a 50-person regulated firm:

1. Write the one-page plan. State who gets what, when, through which channel and who owns it. Name the security lead or HR as owner, and put an annual effectiveness review on the management-review agenda.
2. Brief before access. Cover the rules that bind people, password and MFA hygiene, social engineering and how to report. The NCSC cyber security training for staff guidance centres on phishing, strong passwords, device security and incident reporting, which makes a sound spine for the module.
3. Refresh at least yearly. Re-brief anyone moving into a role with very different risks, without waiting for the calendar.
4. Keep a cheap drumbeat. A security tip in team chat, a short note when a relevant incident makes the news, a poster by the coffee machine. Explain the why as well as the rule, because people follow reasoning better than edicts. Frequency beats production value: a cheap tip every fortnight does more than a polished video once a year.
5. Keep one register. Use an LMS (learning management system) if you have one and a tracked spreadsheet if you don't, recording who completed what, when and with what score.
6. Feed your own incidents back. An event that happened in your firm is worth ten stock examples.

Timing matters as much as content. Start after the policy suite exists, because the training teaches the policies, and well before the audit window, since completion records need months of history to look real. Launching a few months ahead also means the auditor can sample joiners who were briefed under the new process.

What role-specific training do engineers, finance and executives need?

Layer role-specific training on the baseline: secure coding for engineers using OWASP-style material, payment-fraud and invoice-scam drills for finance, and targeted-attack and travel briefings for executives. Auditors ask what a developer gets that a salesperson doesn't, and generic-only training is the most common audit criticism at this scale.

Each tier answers the attack that role actually attracts:

• Engineers: secure coding, so injection flaws are recognised in design and code review rather than in a penetration test report.
• Finance: drills on invoice scams, such as a supplier bank-detail change request that must be verified by a call to a known number.
• Executives: briefings on targeted attacks and on travel, because senior people attract tailored approaches.

At 50 people, three short modules are enough. Sales and operations stay on the baseline, and nobody needs a curriculum committee. What the auditor wants is proof that each role gets what its risks demand, so keep each variant in the materials folder with its own completion records.

One generic module for everyone, with nothing extra for the roles that attract targeted attacks, hides behind a 100% completion rate. The register looks perfect and the exposure sits untouched.

How do you prove staff understood the training?

Test behaviour, not attendance. Short end-of-module quizzes, scheduled phishing simulations, occasional physical drills and post-incident feedback loops each show something different about understanding. Treat results as programme feedback rather than ammunition against individuals, and report trends to management review as evidence that the programme changes behaviour.

People report what they feel safe to report. The NCSC cyber security culture principles describe culture as the collective understanding of what is normal and valued at work, and say it sets expectations on behaviour.

A simulation that shames clickers teaches staff to hide mistakes, which blinds the programme you are trying to measure. Publish click and report rates as trends rather than names, and thank people who report false alarms.

Bring four measures to management review:

• Quiz results: pass rates by module and the questions most often missed.
• Simulation trends: click rate and report rate over time, and who was auto-enrolled into refresher content.
• Drill outcomes: what happened when someone tested tailgating or a clear-desk check.
• Incident feedback: how staff behaved in real events, and what changed in the material afterwards.

The table compares what each method shows and where it can mislead.

What evidence pack do auditors expect for A.6.3?

Auditors expect seven items: the training plan and owner procedure, completion records covering all staff including joiners and contractors, quiz results, policy acknowledgements, the materials with role-specific variants, phishing-simulation reports with resulting changes, and management-review minutes on training effectiveness. Keep them in one register so retrieval takes minutes.

Each item proves something different:

• Plan and owner procedure: the programme is designed and someone is accountable.
• Completion records: everyone was trained, with dates that can be checked against access.
• Quiz results: understanding was checked, not assumed.
• Policy acknowledgements: people accepted the rules that bind them, with acceptable use as the usual anchor.
• Materials: role-specific variants exist and are current.
• Simulation reports: you measure behaviour and act on what you find.
• Management-review minutes: leadership looks at effectiveness and incident trends.

The commonest finding is the register gap: the training happened and nobody can prove it. Contractors are the usual hole when they are onboarded outside the HR process, so route them through the same register as employees.

How is A.6.3 audited, and what grades a major or minor nonconformity?

Auditors sample named individuals (new joiners, a contractor, someone senior) and cross-check completion dates against access-provisioning dates, then interview staff about the reporting route and policy locations. No programme, or induction routinely after access, grades major; overdue refreshers, missing contractor records or stale materials grade minor, aggregating to major as a pattern.

Expect questions like these in the room:

• "Show me the induction training record for your three newest starters. Did any of them get access first?"
• "What does a developer get that a salesperson doesn't?"
• "Pick anyone in the office: how would they report a suspicious email?" The auditor then asks that person.
• "How do you know the training worked? Show me the quiz results or simulation trends."
• "When did the management review last look at this programme?"

The date cross-check is mechanical. The auditor sets each person's completion date beside their start date and their access grant, so sequence is the whole test.

A training record dated after the access grant isn't evidence of control. It's a timestamp on the gap.

Interview answers carry as much weight as the paperwork. The auditor will put the corridor question to whoever is nearest, then ask them to find a policy.

A perfect register plus a blank stare in the corridor is a finding.

Grading follows the pattern. Overdue refreshers with no chase process are visible at a glance in the register, and materials last touched three years ago that mention tools and policies that no longer exist read as abandonment. One of each is a minor. A run of them is how minors become a major.

Prepare for the hallway interview with three habits:

1. Make the reporting route one line. A channel name or mailbox anyone can recite without looking it up.
2. Make policies findable. Staff should reach the policy library in a couple of clicks from the intranet.
3. Rehearse. Before the audit window, put the questions above to three people picked at random, including a contractor.

How does GRC engineering automate the programme?

An HR-platform joiner or role change automatically assigns the right modules and gates access provisioning on completion. A dashboard chases overdue refreshers to the individual, then the manager. Phishing-simulation platforms auto-enrol clickers into refresher content, so an audit question becomes a thirty-second export rather than a week of email archaeology.

The sequencing problem disappears by design. If the HR platform will not trigger system access until the baseline module is complete, nobody can be handed credentials before the briefing, and the major-grade finding from the audit section cannot occur. In practice the gate is a dependency in the joiner workflow: the HR record creates the account, the learning platform assigns the baseline module, and the account stays disabled until the completion event arrives. A day-one induction slot keeps the gate from delaying anyone's first task.

People keep the judgment work: choosing the role tiers, writing examples from your own incidents and owning the effectiveness review at management level. Designing and running that layer is Fractional CISO territory, and building the assignment, monitoring and simulation loops is GRC engineering.

At this scale the commercial effect is speed. A buyer's due-diligence question about training gets a current completion rate and a simulation trend the same day, not a promise to follow up.

Frequently asked questions