For Annex A control 6.3, "Information security awareness, education and training", keep a training plan, completion records per person with dates, and proof the content fits the role. Developers need more than the general course, so add secure coding material and keep a record of who took it.
Where 6.3 sits
Control 6.3 is in the people theme, which has eight controls from 6.1 "Screening" to 6.8 "Information security event reporting". The title covers three things: awareness, education and training. A single yearly slide deck for all staff covers the first. Education and training for specific roles are separate.
For developers, role relevant training connects to secure coding in control 8.28 and the secure development life cycle in 8.25, so your records can serve more than one control.
Evidence that holds up
| Artifact | What it shows |
|---|---|
| Training plan or curriculum | What each role is expected to learn |
| Completion export | Names, dates and results |
| Onboarding checklist | New starters trained within a set period |
| Role matrix | Developers, admins and managers get different content |
| Content review record | The material is kept current |
| Follow up measures | For example phishing reports or review findings over time |
Completion is the minimum. Showing that training changed something is stronger. A drop in a recurring finding type after a workshop is a useful note to keep, as long as you describe it honestly and do not stretch it.
A simple annual cycle
- In January, list roles and the topics each needs.
- Choose formats: short self paced modules for awareness, hands on labs for developers, a session for managers on risk decisions.
- Schedule dates and put them on calendars.
- Collect completions as they happen and chase gaps monthly.
- After incidents or audits, add a short topic to address what went wrong.
- At year end, review the plan and keep the notes.
New joiners should get the baseline within their first weeks, and the record should show the date they started next to the date they finished.
Gaps to check
Contractors and part time staff missing from the completion list. Training content that references old versions of well known risk lists. Completion rates reported without a denominator. Managers exempted without a record of why.
Whatever your numbers are, state them plainly. A ninety percent completion with a documented plan to reach the rest reads better than an unexplained hundred.
Where Safeguard fits
Safeguard offers compliance and evidence automation alongside SBOM and dependency scanning, which can help you collect dated records in one place. You can try the free scan at gold.safeguard.sh/scan. The decision on whether evidence is sufficient stays with your assessor.
Quick check
Do developers need separate training?
The control title is general, but role relevant content is a common way to show the training fits the work. Document the difference between roles.
How often should training be repeated?
The standard text and your policy decide. Many teams use a yearly cycle with onboarding training on joining. Match what you write down.
Sources
- ISO 27001 Annex A controls list, Security Compliance Guide
- ISO 27001 Annex A controls explained, Glocert International
Last reviewed: 19 October 2026.
