In ISO 27001, competence (clause 7.2) means people have the knowledge and skills their ISMS roles need. Awareness (clause 7.3) means people know the security policy, what their own actions mean for the ISMS and what happens if requirements are not met. Training is a method that can build either, not a separate requirement.
The definitions
A public guide to clause 7 summarises it this way. Clause 7.2 requires you to define the knowledge and skills needed for ISMS activities. Where existing competence is not enough, training must be defined and delivered, and measured to confirm the needed level is reached. Clause 7.3 requires that people are made aware of the policy and its contents, what their performance means for the ISMS and its objectives, and what implications nonconformities have.
Side by side
| Competence (7.2) | Awareness (7.3) | |
|---|---|---|
| Who | People whose work affects security performance | Everyone in scope |
| What | Skills and knowledge for a role | Policy, personal contribution, consequences |
| How shown | Role requirements, qualifications, training results | Acknowledgements, briefings, quiz results |
| Example | Engineer who runs the vulnerability process can use the scanner and triage | Every employee knows how to report an incident |
What to do for competence
- List the roles that affect the ISMS: security lead, engineers, admins, HR, support.
- For each, write the skills needed in a line or two.
- Compare with what each person has today, through experience or past courses.
- Close gaps with training or mentoring, and record the result.
- Keep records: qualifications, course completion, review notes.
Measure outcomes, not only attendance. A short practical task or a reviewed pull request can show a skill better than a certificate.
What to do for awareness
- Give each new joiner the policy and a short briefing.
- Repeat on a schedule, and when policies change.
- Cover how to report incidents and why compliance matters.
- Keep dated acknowledgements and quiz results.
For developers, see secure coding training evidence, which relates to Annex A control 6.3.
How this links to Annex A
Annex A control 6.3 is about awareness, education and training. Clauses 7.2 and 7.3 are management system requirements, so do not rely on a control record alone. Your clause level records should show you decided what competence you needed and checked it.
Common problems
- Training everyone on the same generic course and calling it competence.
- Records that show attendance but not what was learned.
- New joiners missing the briefing because onboarding does not trigger it.
- No link between a nonconformity and a training action.
Quick check
Is an annual security awareness course enough?
It supports awareness. Competence for specific roles may need more targeted training and a way to check the result.
Do contractors need to be aware too?
If they work within scope and affect the ISMS, include them. Confirm how your certification body expects contractors to be covered.
Safeguard's compliance and evidence automation can help keep training and acknowledgement records with other audit evidence. It does not deliver training courses.
Sources
Last reviewed: 19 October 2026.
