ISO/IEC 27001:2022 Clause 7.3 awareness: what auditors test

The auditor stops a contractor in the corridor and asks where the security policy lives. The contractor doesn't know, and the completion report in your folder says otherwise.

This guide covers ISO/IEC 27001:2022 Clause 7.3 awareness for Information Security Managers and Compliance Leads preparing for a Stage 2 or surveillance audit. It sets out what the clause requires, who it covers, what auditors ask and how to build a programme that produces its own evidence.

What is ISO 27001 Clause 7.3, and why does awareness mean comprehension?

ISO 27001:2022 Clause 7.3 awareness means everyone working under your direction understands the security policy, their own contribution and the consequences of ignoring it. The requirement is a state of understanding, not a training artefact. Certificates are how you evidence it, but auditors test whether people actually know.

Most successful attacks on firms of your size come through people, not infrastructure. A phishing email, a payment-fraud approach, a convincing message to the one person who can change supplier bank details. The ICO Personal data breaches guide names human error as the leading cause of reported data breaches and lists mandatory induction and refresher training among its recommended responses.

ISO 27001 7.3 is the cheapest control in the information security management system (ISMS) and the one with the widest blast radius when it is missing. Every technical control depends on someone using it properly. A well-built approval workflow still fails when a person waves through the request they should have questioned.

The failure is also public inside your own audit. A missing document is a paper problem, whereas a blank answer from a named colleague puts your people on the record. Staff are not the weakest link here. They are the first line of defence, provided they know what the policy asks of them.

What are the ISO/IEC 27001:2022 Clause 7.3 awareness requirements?

Clause 7.3 mandates three messages for all personnel: that an information security policy exists and what it asks of them, how their own behaviour helps the ISMS work, and what follows if they ignore the requirements. Auditor interviews follow exactly this script, so your content must visibly carry all three.

Each message maps to an interview question, so treat the three as a content checklist:

• The policy exists and applies to me. Staff can say where the information security policy lives and what it asks of their own role.
• My behaviour makes the ISMS work. Staff can name things they personally do that keep the company secure, such as reporting a suspicious email or challenging a bank-detail change.
• Ignoring the rules has consequences. Staff can say, without bluster, what follows if they do not comply, including disciplinary action where your HR process provides for it.

The common gap is the second message. Content tends to recite the policy and stop, so staff finish the module knowing what the rules are but not what part they play. Rewrite each module around actions the learner takes, with examples drawn from their own job.

Check the content before you check the completion rate. Open each induction module and refresher and tick the three messages against it. A module carrying only one of them produces interviewees who can answer only one of the three questions.

State the consequences plainly and early. People respond better to a clear account of why the rules exist and what follows when they are ignored than to a warning buried on the final slide.

How does Clause 7.3 differ from Clause 7.2, Clause 5.2 and Annex A 6.3?

Clause 7.3 covers what everyone must understand; Clause 7.2 covers what specific roles must be able to do. Clause 5.2 supplies the policy people must know, and Annex A 6.3 covers the training machinery that delivers it. Treat them as one chain, with 7.3 as the comprehension test.

Read the four as links in that chain:

• Clause 5.2, the policy. The statement people must know. Without it, awareness has nothing to teach.
• Clause 7.2, competence. What specific roles must be able to do.
• Clause 7.3, awareness. What everyone must understand: the policy, their contribution and the consequences.
• Annex A 6.3, the training control. The machinery that delivers awareness, tested in depth in its own right.

The distinction matters in the room. A finance analyst can complete a payment-controls course, which speaks to competence, and still be unable to say where the policy lives, which is an awareness failure. Keep the two evidence trails separate so one does not hide a gap in the other.

Who is 'under the organisation's control': do contractors, temps and the board count?

Yes. Clause 7.3 covers everyone operating under your direction: employees, the executive team, contractors, agency and temporary workers, and relevant third parties. Directors are the group most reliably missing from programmes, and contractors are where coverage gaps hide. Any exclusion from the programme is a finding waiting to happen.

The executive team gets missed for understandable reasons. Directors are busy, they sit outside the induction flow, and the attacks aimed at them differ from the ones aimed at the front line. Those are reasons to tailor the content, not to excuse the audience.

An awareness programme that exempts the board hasn't got a scope. It has a hierarchy.

Contractors, agency and temporary staff fail for a different reason: they are not on the payroll list that most programmes start from. Auditors know this, which is why they favour contractors when they pick interviewees.

Build the audience list from everyone holding an account, a badge or a key rather than from HR headcount, and the board and contractors are in by default. Relevant third parties, such as a supplier whose staff work inside your systems, get the same three messages in a form proportionate to their access.

How do you deliver awareness across the employee lifecycle?

Deliver awareness at four lifecycle points: induction before system access, a periodic refresher, a targeted boost after any incident, and a reminder of surviving obligations at exit. Tailor content to role risk, and mix channels, because a single annual e-learning hour technically exists but changes nothing.

Start with a written awareness plan of one or two pages: what gets delivered, to whom, when, and the numbers you will watch. The plan turns the programme from ad hoc reminders into a deliberate one, and it gives every later metric a stated target.

Induction before access is the point that matters most. A joiner who has the system but not the three messages is exactly the interviewee an auditor wants to find. After an incident, target the affected team with content built from what actually happened. At exit, remind leavers of obligations that survive their departure, such as confidentiality.

Tailor by role risk rather than job title:

• Finance: payment-fraud and fake-invoice scenarios, including the urgent bank-detail change.
• Engineering: secure development habits.
• HR: personal-data handling.
• Executives: the attacks aimed specifically at them.

Channel mix matters as much as content. Short frequent content, simulated phishing and bulletins tied to real events do work that an annual hour of e-learning cannot. A bulletin sent the week after a genuine incident teaches more than a module written a year earlier.

The NCSC Cyber Assessment Framework Principle B6 Staff awareness and training points the same way: training should be tailored to job roles and judged by its effect on security behaviours, not by how many people it reached. An annual-only module with identical content for everyone fails both halves of that test.

Delivered this way, the programme stays small enough for a 50-person firm to run and specific enough to defend in an interview. The table shows what each lifecycle point triggers and what it leaves behind as evidence.

How do you measure whether Clause 7.3 awareness is working?

Measure behaviour, not attendance. Track simulation click and report rates over time, retention quiz results, and how often people proactively raise suspicious activity. NCSC guidance says to focus on how many people reported a phishing email, not only how many clicked, and a rising report rate is the strongest signal.

The NCSC Guidance on Defending Against Phishing Attacks also steers away from punitive measures, because they discourage early escalation. Early escalation is what limits the damage. Staff who would recognise an attack but don't know who to tell give you no signal at all.

Make the reporting route unmissable:

• One obvious route. A single mailbox or button, named in induction and visible where people work.
• No blame for near-misses. Someone who clicked and then reported has done the right thing and should hear it.
• Visible follow-up. Tell the reporter what happened next, so reporting feels worthwhile.

A blame-heavy phishing test teaches staff to hide mistakes, not to spot attacks.

Run the retention quiz some weeks after the training, not at the end of the module. That way it measures what stuck, not what was just read. A completion percentage tells you who sat through the content. A rising report rate tells you who would act when it matters.

What do auditors ask staff about Clause 7.3, and when does a gap become a major nonconformity?

Auditors test Clause 7.3 by interviewing people across functions and seniority, favouring recent joiners and contractors. They ask where the policy lives, what you personally do, what happens if you ignore it, and how you'd handle a suspicious email. One blank is minor; several failures, or a programme existing only on paper, aggregate to major.

A passing answer to each of the four questions sounds like this:

• "Where would you find the security policy, and what does it mean for your job?" The person names the location and gives one practical implication for their role.
• "What do you personally do that keeps the company secure?" One or two concrete habits, in their own words.
• "What would happen if you didn't follow these requirements?" A plain acknowledgement of consequences, without guessing.
• "You spot a suspicious email: what exactly do you do?" A walk through the real reporting route.

A policy suite nobody can locate is undone in thirty seconds, in the corridor, on the record.

Sampling is deliberate. Interviewees are picked across functions and seniority, with recent joiners and contractors the favourites because coverage gaps live there. Your newest contractor is therefore the most likely person to be asked, and the one most likely to have missed the full programme.

Certification bodies grade this clause along these lines:

• No awareness activity at all: the absence of the requirement, graded major.
• A sampled individual draws a blank, contractor coverage is missing, or records stop months ago: graded minor.
• Several interviews fail and the programme reads as existing on paper only: the minors aggregate to major.

Rehearse before the auditor does. Pick five people across functions, including the newest contractor and one director, and ask the four questions cold. Every blank answer is a content gap or a coverage gap, and either is cheaper to fix now than to explain later.

What documentary evidence proves Clause 7.3 awareness to an auditor?

The ISMS owner needs seven kinds of evidence: the awareness plan, timestamped completion logs, phishing simulation trends, retention quiz and evaluation records, the bulletins actually sent, spot-check walk records, and post-incident refresher and near-miss figures. Trend lines beat snapshots, and months of accumulated records beat a last-minute pack.

The documentary pass follows the interviews. The ISMS owner shows completion records across all roles, evidence that the programme tracks the current risk picture, and simulation data showing behaviour is shifting. Any person the auditor met in the corridor should be one search away.

Three habits make the pack hold up:

• Date everything. Timestamps come from the system, not from a spreadsheet filled in afterwards.
• Keep the trend. Retain every simulation round, so the line shows direction rather than a single point.
• Key records to individuals. Contractors and directors included.

Behaviour trends only exist once you have been measuring. A pack assembled the week before audit can show a plan and a few certificates, but it cannot show a report rate rising.

How do you automate the Clause 7.3 awareness pipeline?

Run awareness as an event-driven pipeline: the HR system's new-starter event assigns induction, phishing platform results feed a report-rate dashboard, closing an incident auto-assigns refreshers to the affected team, and an auditor's sampling request becomes an export rather than an email hunt. Contractors are included from day one.

Each step replaces a manual chore with an event:

1. Joiner trigger. The new-starter event creates the induction assignment, and completion is recorded as it happens. Contractors raised through the same request process get the same trigger, and account provisioning can wait for completion.
2. Simulation telemetry. Phishing platform results flow into a trend dashboard, so report rate is current for every management review.
3. Incident-driven refreshers. Closing an incident assigns targeted content to the affected team, and the trigger is saved as proof that the programme responds to events.
4. Evidence on demand. "Show me this contractor's records" becomes a query and an export.

Learning-platform webhooks carry completion events into your evidence store with system timestamps. That removes the screenshots-and-spreadsheets habit, and the doubt that comes with it.

Automation does not replace backing from the top. Staff correctly read a programme starved of time, budget and visible management support as "this doesn't matter". Designing the role-tailored content, owning its metrics and giving it senior backing is Fractional CISO work. Building the pipeline above is GRC engineering work, and our ISO 27001 engagements cover Clause 7.3 as part of the whole standard.

Frequently asked questions