ISO 27001 Annex A 6.3 Information security awareness, education and training program
What it says
Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies and procedures, as relevant for their job function.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure everyone gets regular training and updates on information security relevant to their job.
This control is about making sure everyone in the organisation knows how to handle information safely and securely. If people aren't aware of their responsibilities, sensitive information could be accidentally shared or lost, leading to financial loss, damage to reputation, or legal troubles.
Free. Save your status, tasks and notes.
Why it matters
Without regular security awareness and training, staff are more likely to fall for phishing or mishandle data, causing breaches, reputational harm and legal liability.
How to implement
The HR manager should organise regular training sessions for all staff on information security practices, ensuring these sessions cover current company policies.
Use a mix of workshops, online modules, and guest speakers to keep the content engaging and relevant.
The IT manager should tailor additional technical training sessions for staff whose roles involve more complex data management.
This can include interactive sessions on safe data handling and configuring security settings, with experts brought in as needed.
Management needs to lead by example, showing their commitment to the program by participating in and promoting ongoing security awareness activities.
This could include addressing employees during meetings or in newsletters to highlight the importance of security practices.
The training coordinator should assess the effectiveness of these programs by collecting feedback and conducting quizzes after sessions.
Use this information to continually improve the training content and delivery methods, as guided by the ISO 27002:2022 standards.
The compliance officer should ensure training aligns with local regulations such as the Privacy Act 1988.
They can do this by periodically reviewing training content against relevant legal requirements and capturing these changes in documentation.
Keep it running
Deliver role-based security awareness and training at induction and regularly, track completion, and update modules when threats or policies/procedures change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The organisation's information security training schedule and materials.
Look at
Whether all relevant roles and security topics are covered in line with organisational policy. GOOD is when the schedule is comprehensive, regularly updated, and includes different types of training (e.g., workshops, online, guest speakers).
- Check 2 of 5What an auditor asks for
Ask for
Records of attendance to training sessions.
Look at
These records to ensure consistent participation across different levels of staff. GOOD means seeing high attendance and participation rates documented for each session.
- Check 3 of 5What an auditor asks for
Ask for
Feedback and assessment results post-training.
Look at
How these results are used to improve future training. GOOD is if feedback is actively used to refine training, with examples of how past sessions have been adapted or improved.
- Check 4 of 5What an auditor asks for
Ask for
Examples of management communication supporting the training program.
Look at
Emails, newsletters, or meeting notes. GOOD shows visible management endorsement and regular communication underscoring the importance of security.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of compliance checks against Australian regulations like the Privacy Act 1988.
Look at
How the organisation adapts training to meet these requirements. GOOD is documentation showing periodic reviews and updates to training content based on legal changes.
Mappings
Closest match in ASD Information Security Manual: ISM-0229, Guidelines for discussing sensitive information over phones, which this control covers in full and more.
ASD Information Security Manual: 32 mappings
This control is broader than ISM-0229.
ISM-0229 requires personnel to be advised what sensitivity or classification of information is permitted to be discussed over internal and external telephone systems. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide information security awareness, education and training program covering policies and procedures relevant to job functions, which is the natural vehicle for communicating phone discussion rules. ISM-0229 is a specific, topic-level awareness requirement focused on telephony, while Annex A 6.3 is broader and covers awareness across many topics beyond phone communications.
This control is broader than ISM-0230.
ISM-0230 requires personnel to be advised of the security risks of using non-secure telephone systems in areas where sensitive or classified conversations can occur. Annex A 6.3 requires an organisation-wide information security awareness, education and training program, which would typically include guidance on secure communications channels (including telephony) where relevant to roles. ISM-0230 is a topic-specific awareness requirement, while Annex A 6.3 is broader and covers awareness across many security topics and audiences.
This control is broader than ISM-0435.
ISM-0435 requires personnel to receive any necessary briefings before being granted access to systems and their resources. ISO/IEC 27001:2022 Annex A 6.3 establishes an organisation-wide information security awareness, education and training program (including updates to policies and procedures) which can encompass pre-access briefings. ISM-0435 is more point-in-time and access-gating focused, whereas Annex A 6.3 is broader and ongoing across the employment lifecycle.
This control is broader than ISM-0610.
ISM-0610 requires users to be trained on the secure use of Cross Domain Solutions (CDSs) before access is granted. Annex A 6.3 requires an organisation-wide information security awareness, education and training program appropriate to job functions, which would encompass role-based training for specialised systems like CDSs. ISM-0610 is more specific (CDS-focused and tied to access being granted), whereas Annex A 6.3 is broader and covers training across many topics and roles.
This control is broader than ISM-0612.
ISM-0612 requires that system administrators for gateways are formally trained on the operation and management of those gateways. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide information security awareness, education and training program tailored to job functions, which would include training for gateway administrators. ISM-0612 is a specific role-and-technology instance of the broader training program expectations in Annex A 6.3.
This control is broader than ISM-0817.
Annex A 6.3 requires organisations to deliver information security awareness and training appropriate to roles, including behavioural expectations and reporting pathways. ISM-0817 requires advising personnel about suspicious online contact and how to report it, which is a discrete awareness topic. ISM-0817 is therefore a subset of what Annex A 6.3 would cover within a broader, ongoing program.
This control is broader than ISM-0821.
Annex A 6.3 requires role-relevant information security awareness and regular updates to policies and procedures. ISM-0821 is a specific awareness topic requiring personnel to be advised about risks of posting personal information online and using privacy settings. ISM-0821 is therefore a subset topic that could be delivered within the broader Annex A 6.3 training program.
This control is broader than ISM-0824.
ISM-0824 advises personnel not to send or receive files via unauthorised online file services. Annex A 6.3 requires an information security awareness, education and training program so personnel understand and follow security policies and procedures. Training and awareness directly supports effective implementation of ISM-0824 by ensuring staff recognise what services are unauthorised and the risks of using them, but Annex A 6.3 does not itself define the prohibition.
This control is broader than ISM-1083.
Annex A 6.3 requires role-appropriate awareness and regular updates to information security policy and topic-specific procedures. ISM-1083 is a specific awareness requirement to advise personnel about what sensitivity/classification is permitted for mobile voice and data communications. ISM-1083 would typically be delivered as part of the Annex A 6.3 program, but it does not cover the broader education/training program obligations.
This control is broader than ISM-1146.
ISM-1146 advises personnel to maintain separate work and personal online accounts for online services. Annex A 6.3 requires an information security awareness, education and training program to ensure personnel understand and follow security expectations. Training and awareness (Annex A 6.3) is a key mechanism to communicate and reinforce the separation behaviour required by ISM-1146, but it does not itself mandate that specific separation practice.
This control is broader than ISM-1298.
ISM-1298 requires that personnel are advised of privacy and security risks when travelling overseas with mobile devices. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide awareness, education and training program with regular updates on relevant security policies and procedures. ISM-1298 fits as a specific, topic-focused awareness requirement (overseas mobile device risks) that would typically be delivered through the broader training and awareness framework mandated by Annex A 6.3.
This control is broader than ISM-1565.
ISM-1565 requires annual, role-tailored training for all personnel holding privileged access so elevated rights are used safely. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide information security awareness, education and training program with content appropriate to job function and regular updates. ISM-1565 is a specific, privileged-user subset and cadence requirement within the broader training program scope of Annex A 6.3.
This control is broader than ISM-1740.
Annex A 6.3 requires an organisation-wide, role-appropriate security awareness and training program with regular updates to relevant policies and procedures. ISM-1740 is a specific instance of that requirement, mandating training for staff who handle banking details and payment requests on business email compromise and reporting expectations. ISM-1740 is narrower in scope (one threat scenario and one role group) than Annex A 6.3.
This control is broader than ISM-2002.
ISM-2002 requires the board of directors or executive committee to maintain enough cyber security literacy to meet its fiduciary duties and legislative or regulatory obligations. Annex A 6.3 requires personnel and relevant interested parties to receive awareness, education and training suited to their role, and board literacy is typically built and maintained through that education. ISM-2002 applies only to the board or executive and focuses on governance-level literacy, whereas Annex A 6.3 covers all personnel and includes regular policy updates.
This control is broader than ISM-2022.
ISM-2022 requires an organisation to develop, implement and maintain a cyber security awareness training register to record all awareness training activities. Annex A 6.3 requires the organisation to run an information security awareness, education and training program (including regular updates) for personnel and relevant interested parties. A training register is a supporting artefact/evidence mechanism within a broader training program, but Annex A 6.3 also covers content, coverage and delivery that ISM-2022 does not specify.
This control is broader than ISM-2037.
ISM-2037 requires that software developers who lack sufficient cyber security knowledge and skills undertake suitable training in secure software development and programming practices. Annex A 6.3 requires an organisation-wide information security awareness, education and training program for personnel and relevant interested parties, tailored to job functions. ISM-2037 fits as a role-specific instantiation of that broader training obligation, focused specifically on secure development competencies rather than general security awareness.
This control is broader than ISM-2071.
Annex A 6.3 requires the organisation to provide role-relevant information security awareness, education, and training with regular policy/procedure updates. ISM-2071 fits within this by requiring targeted training for personnel handling user account details on recognising, managing, and reporting social engineering attacks. ISM-2071 is topic-specific, while Annex A 6.3 is an overarching program requirement spanning many topics and roles.
This control is broader than ISM-2104.
ISM-2104 provides a specific piece of security guidance: do not post security clearance and briefing details online and report if it occurs. ISO/IEC 27001:2022 Annex A 6.3 requires a broader information security awareness, education and training program, under which ISM-2104 would typically be delivered as a topic-specific rule (e.g. OPSEC and acceptable online conduct). ISM-2104 is therefore a specific training/awareness requirement within the wider Annex A 6.3 program scope.
This control is broader than ISM-2105.
ISM-2105 requires personnel to be advised to limit posting work-related duties on unauthorised online services and to report cases where such information is posted. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide security awareness, education and training program that provides role-relevant guidance and updates to personnel. ISM-2105 is a specific awareness message and expected behaviour that would typically be delivered through the broader training and awareness program required by Annex A 6.3.
This control is broader than ISM-2106.
ISM-2106 requires personnel to be advised to limit posting work-related skills and experience on unauthorised online services and to report instances where such information is posted. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation-wide security awareness, education and training program that would include guidance on safe online behaviour and reporting expectations. ISM-2106 is a specific awareness message focused on online professional/profile disclosure, whereas Annex A 6.3 is broader and covers ongoing awareness across many topics.
This control is broader than ISM-2107.
ISM-2107 encourages personnel to actively configure privacy settings on online services to restrict who can view personal information they post, reducing personal data exposure that can enable social engineering or targeting. ISO/IEC 27001:2022 Annex A 6.3 requires an organisation to run an information security awareness, education and training program that can explicitly include OPSEC/social media safety content (e.g., how to use platform privacy controls, why oversharing increases spear‑phishing risk, and what "public" visibility means). In practice, Annex A 6.3 is the auditable organisational mechanism used to communicate, train, and refresh the specific ISM-2107 behaviour; however, Annex A 6.3 does not itself mandate this particular privacy-setting action, while ISM-2107 does.
This control partially meets ISM-1644.
ISM-1644 addresses operational behaviour to prevent inadvertent disclosure during conversations in public areas. Annex A 6.3 requires an awareness, education, and training program so personnel understand and follow information security policies and procedures, including expectations about discussing sensitive matters in public. ISM-1644 is a specific rule to be taught and reinforced, whereas Annex A 6.3 is the broader mechanism for ensuring personnel know and comply with such rules.
This control partially overlaps ISM-0252.
Annex A 6.3 requires personnel and relevant interested parties to receive appropriate information security awareness, education, and training with regular updates of security policies and procedures relevant to their job function. ISM-0252 directly relates by mandating annual cyber security awareness training for all personnel and specifying core content areas such as authorised use, protection expectations, and incident reporting. ISM-0252 is more prescriptive on minimum topics and a yearly cadence, while Annex A 6.3 also covers education/training beyond awareness and includes relevant interested parties and policy update obligations.
This control partially overlaps ISM-1554.
ISM-1554 requires personnel travelling to high or extreme risk countries to follow specific behaviours (use dedicated work devices/accounts, apply and inspect tamper seals, and avoid personal rooted/jailbroken devices). Annex A 6.3 requires an information security awareness, education and training program to ensure personnel understand and follow required security practices. Annex A 6.3 supports ISM-1554 by providing the mechanism to train travellers on tamper seals and safe device handling, but it does not itself mandate the travel-device provisioning controls.
This control partially overlaps ISM-1602.
ISM-1602 requires cyber security documentation and changes to be communicated to all stakeholders. ISO/IEC 27001:2022 Annex A 6.3 requires personnel and relevant interested parties to receive awareness/training and regular updates of policies and procedures relevant to their job function, which includes communicating key documentation changes. The difference is that Annex A 6.3 is training/awareness-focused and role-relevance based, while ISM-1602 is a direct documentation communication requirement to all stakeholders.
This control partially overlaps ISM-2035.
ISM-2035 requires security roles, responsibilities and knowledge requirements to be identified and documented to support the software development life cycle. ISO/IEC 27001:2022 Annex A 6.3 requires security awareness, education and training to be provided as relevant to personnel job functions, which includes secure development roles. The overlap is in identifying and addressing capability needs for people, but Annex A 6.3 focuses on delivering training, whereas ISM-2035 focuses on defining and documenting SDLC security role expectations and required knowledge.
This control partially overlaps ISM-2121.
ISM-2121 requires organisations to avoid using developers who lack sufficient cyber security knowledge and skills for the work they are assigned. ISO/IEC 27001:2022 Annex A 6.3 overlaps by requiring appropriate information security awareness, education and training aligned to job function, which is a primary mechanism for building and maintaining developer security competence. Annex A 6.3 is broader across all personnel and emphasises ongoing training, while ISM-2121 is specifically about developer suitability/assignment decisions for projects or tasks.
This control supports ISM-1864.
ISM-1864 requires a system usage policy to be created and maintained to define expected system use. Annex A 6.3 supports this by requiring awareness, education, and training so personnel receive updates and understand relevant policies and procedures, including acceptable use expectations. ISM-1864 is primarily about the policy artefact and its enforcement, while Annex A 6.3 is about ensuring people know and can apply it.
This control supports ISM-2004.
Annex A 6.3 requires organisations to provide appropriate awareness, education and training with regular policy and procedure updates relevant to roles. ISM-2004 focuses on executive-level support for developing cyber security skills and experience through internal and external awareness and training opportunities.
This control supports ISM-2038.
ISM-2038 requires organisations to implement and maintain a register of software developers' cyber security knowledge and skills. Annex A 6.3 requires an organisation-wide information security awareness, education and training program, which is a primary mechanism for building and maintaining the competencies that would be recorded in the ISM-2038 register. Annex A 6.3 focuses on delivering training, while ISM-2038 focuses on evidencing, tracking and managing developer capability over time.
This control depends on ISM-0720.
ISM-0720 requires the CISO to oversee a cyber security communications strategy that communicates the organisation's cyber security vision and strategy. That strategy provides a structured channel for the ongoing awareness and regular updates that Annex A 6.3 requires personnel and relevant interested parties to receive. Annex A 6.3 also requires education and role-based training, which a communications strategy alone does not deliver.
This control depends on ISM-0735.
ISM-0735 requires the CISO to oversee the development, implementation and maintenance of the organisation's cyber security awareness training program. That program is the mechanism through which personnel receive the awareness, education, training and policy updates required by Annex A 6.3. ISM-0735 assigns executive oversight of the program, whereas Annex A 6.3 focuses on personnel actually receiving role-appropriate training.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-14.1Require role-tailored cyber security awareness training before granting accessBroader than
This control is broader than IT.PRO-14.1.
IT.PRO-14.1 requires all personnel to receive cyber security awareness training tailored to how they will use systems, applications and data in their roles before they are granted access. This directly implements the role-relevant awareness training required by Annex A 6.3, adding the condition that it is completed before access is given. Annex A 6.3 is broader, also covering education, regular updates on the organisation's policies and procedures, and relevant interested parties as well as personnel.
- IT.PRO-14.2Regularly update and deliver security awareness training as threats and operations changeBroader than
This control is broader than IT.PRO-14.2.
IT.PRO-14.2 requires cyber security awareness training to be updated and delivered regularly so that it reflects current threats and operational considerations. This directly implements the ongoing awareness training and regular updates required by Annex A 6.3. Annex A 6.3 is broader, also covering education, updates on the organisation's information security policies and procedures, relevance to each job function and relevant interested parties.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation