ISO 27001 Security Awareness Training: What Certification Bodies Actually Check
Imagine a compliance manager who’s six weeks from a Stage 2 audit and feels good about training. Everyone finished the modules. The completion report sits in a folder helpfully labeled Evidence — this looks like the one item on the list that’s actually done.
Then, the auditor asks something the folder can’t answer: How does this training tie back to the risks the organization identified? Nobody built that connection, so there’s nothing to point to.
What does ISO 27001 actually require for security awareness training?
ISO 27001 security awareness training requirements live inside ISO 27001 Control 6.3, officially titled “Information security awareness, education, and training.” These security awareness training requirements live inside Control 6.3, which is the direct descendant of Control A.7.2.2 from the 2013 standard’s Human Resource Security domain. (The 2022 revision moved it under the new People theme.)
And Control 6.3 isn’t the only place awareness shows up. Clause 7.3, outside of Annex A entirely, requires that everyone working under the organization’s control understands the security policy, their own contribution to the ISMS (Information Security Management System), and what happens if they don’t conform.
Think of it like this: Clause 7.3 sets the bar that everyone clears, while Control 6.3 is where role-specific, risk-mapped training does the heavier lifting.
Strip away the formal language, and the requirement is simple: Employees, contractors, and any third party who touches the organization’s information need ongoing, role-relevant awareness, education, and training.
A slideshow uploaded during someone’s first week and never revisited again doesn’t meet that requirement. The standard expects the program to keep up as policies change, new threats emerge, and people move into new roles.
That much is standard practice already. Where programs tend to miss the mark is in the layer underneath it, in the part auditors actually dig into.
The checkbox mistake behind Control 6.3
A lot of compliance teams assume ISO 27001 training requirements are satisfied once training exists and people finish it. A vendor’s course library gets assigned, certificates get filed, and the control gets checked off. That’s often where the effort stops.
A certification body checks for more than attendance: Training that reflects the risks this organization identified in its own risk assessment, not a generic curriculum every company in the industry already runs. That connection, a real risk tied to real training, is exactly what a generic program can’t produce.
ISO 27001 functions as one connected management system, not a checklist of unrelated requirements. A system like that only works when every piece, including training, is linked to the one before it.
The real chain: Risk assessment, the Statement of Applicability, and training content
Two clauses outside Annex A do most of the real work here.
Clause 6.1.2, information security risk assessment
Asks an organization to set its own risk criteria and identify the risks that could affect its information. From there, it works out how likely each risk is and what it would cost, then weighs the results against those criteria.
Clause 6.1.3, risk treatment
Where those findings turn into decisions. The organization picks controls to address what it found, checks that list against Annex A for gaps, and produces a Statement of Applicability, a document naming every applicable control, whether it’s in place, and the reasoning behind that choice.
Auditors tend to treat the Statement of Applicability as close to a map for the whole audit, since it tells them what the organization decided mattered and what it did about it.
Control 6.3, Information security awareness, education, and training
The one entry on this list which reframes what a certification body is really asking. The real test is whether the training people received traces back to a risk the organization named, in a way someone can point to on request.
Generic password-hygiene training sitting next to a risk register full of phishing incidents is the kind of mismatch an auditor would notice. What holds up is training that maps directly to risks the Statement of Applicability names.
What is the ISO 27001 Statement of Applicability, and why does it matter for training?
The ISO 27001 Statement of Applicability is the document Clause 6.1.3 requires. It’s a record of which Annex A controls an organization has adopted, whether each has been implemented, and why.
For training, its job is to tie Control 6.3 back to real risks from the risk assessment, which is what keeps awareness training from operating as a stand-alone HR task disconnected from the rest of the system.
Where this differs from HIPAA and SOC 2
HIPAA’s security awareness training requirements center on one required standard paired with several ‘addressable’ specifications, tied to a federal rule that carries civil penalties.
SOC 2 Type II handles it differently, largely through the Trust Services Criteria’s control environment and communication principles — the harder problem there is proving a control ran consistently, not that it existed on paper.
ISO 27001 asks something different from either of those: Whether the risk assessment, the treatment decisions, the controls, and the training connect as one chain. That’s what makes it the most process-oriented framework of the three we’re covering in this series, since the certification body here is evaluating the whole system rather than any single requirement inside it.
What good evidence looks like before the audit
Organizations that walk into a Stage 2 audit with real confidence tend to share a few habits:
- Training content maps to specific entries in their risk register or Statement of Applicability, not a generic template.
- Cadence follows the risk assessment rather than an arbitrary date on the calendar, usually settling into at least an annual refresh, with extra sessions added whenever a new risk or policy shows up.
- Records should tie to a specific risk-training topic and note when the organization delivered it and when it last reviewed it.
That annual cadence reflects common practice built on the standard’s intent, not a line quoted directly from the ISO text, so treat it as planning guidance rather than a strict requirement.
Getting there means deciding, deliberately, that training follows the risk assessment instead of running beside it as a separate task.
Where to go from here
If your organization already runs training, you’re most of the way there. The part that earns certification isn’t more content or a bigger program, it’s honesty about the risks specific to your organization and training that actually answers to them. Document that connection, and you have what a certification body is looking for.
Frequently Asked Questions
ISO 27001 requires an ongoing, role-relevant training program under Control 6.3, covering employees, contractors, and any third party with access to the organization’s information. The requirement itself is straightforward. What certification bodies check is whether that training reflects the risks identified in the organization’s own risk assessment, not a generic curriculum.
Control 6.3, “Information security awareness, education, and training,” sits in the People theme of Annex A in the 2022 version of the standard. It replaced Control A.7.2.2 from the 2013 version and requires an ongoing awareness and training program tailored to people’s roles.
Yes. Control 6.3 in Annex A specifically addresses information security awareness, education, and training. It’s one of the controls organizations evaluate through their risk assessment and Statement of Applicability. In practice, almost no organization can justify excluding it, since the human element touches nearly every risk category a typical assessment identifies.
Start with the risk assessment already completed under Clause 6.1.2, then map each specific risk to a related training topic, so the connection is documented rather than assumed. Keep records showing when training was delivered, to whom, and when it was last reviewed, ideally referencing the same risks named in the Statement of Applicability. The mapping, more than the training content itself, is what auditors want to see.
