verifiedISO/IEC 27001:2022
ISO 27001 Annex A 6.3Information security awareness, education and training program
Official control statement
Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies and procedures, as relevant for their job function.
verifiedISO/IEC 27001:2022Annex A 6.3
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure everyone gets regular training and updates on information security relevant to their job.
People controlsISO/IEC 27001:2022
record_voice_over
What this means in practice
This control is about making sure everyone in the organisation knows how to handle information safely and securely. If people aren't aware of their responsibilities, sensitive information could be accidentally shared or lost, leading to financial loss, damage to reputation, or legal troubles.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
People controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
priority_high
Why it matters
Without regular security awareness and training, staff are more likely to fall for phishing or mishandle data, causing breaches, reputational harm and legal liability.
settings
Operational notes
Deliver role-based security awareness and training at induction and regularly, track completion, and update modules when threats or policies/procedures change.
02 - Implement
build
Implementation tips
- The HR manager should organise regular training sessions for all staff on information security practices, ensuring these sessions cover current company policies. Use a mix of workshops, online modules, and guest speakers to keep the content engaging and relevant.
- The IT manager should tailor additional technical training sessions for staff whose roles involve more complex data management. This can include interactive sessions on safe data handling and configuring security settings, with experts brought in as needed.
- Management needs to lead by example, showing their commitment to the program by participating in and promoting ongoing security awareness activities. This could include addressing employees during meetings or in newsletters to highlight the importance of security practices.
- The training coordinator should assess the effectiveness of these programs by collecting feedback and conducting quizzes after sessions. Use this information to continually improve the training content and delivery methods, as guided by the ISO 27002:2022 standards.
- The compliance officer should ensure training aligns with local regulations such as the Privacy Act 1988. They can do this by periodically reviewing training content against relevant legal requirements and capturing these changes in documentation.
03 - Audit
fact_check
Audit / evidence tips
- AskThe organisation's information security training schedule and materialsLook atWhether all relevant roles and security topics are covered in line with organisational policy. GOOD is when the schedule is comprehensive, regularly updated, and includes different types of training (e.g., workshops, online, guest speakers)
- AskRecords of attendance to training sessionsLook atThese records to ensure consistent participation across different levels of staff. GOOD means seeing high attendance and participation rates documented for each session
- AskFeedback and assessment results post-trainingLook atHow these results are used to improve future training. GOOD is if feedback is actively used to refine training, with examples of how past sessions have been adapted or improved
- AskExamples of management communication supporting the training programLook atEmails, newsletters, or meeting notes. GOOD shows visible management endorsement and regular communication underscoring the importance of security
- AskEvidence of compliance checks against Australian regulations like the Privacy Act 1988Look atHow the organisation adapts training to meet these requirements. GOOD is documentation showing periodic reviews and updates to training content based on legal changes
04 - Mappings
link
Cross-framework mappings
How Annex A 6.3 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ASD ISM
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(21)expand_less | ||
| ISM-0229 | ISM-0229 requires personnel to be advised what sensitivity or classification of information is permitted to be discussed over internal an... | |
| ISM-0230 | ISM-0230 requires personnel to be advised of the security risks of using non-secure telephone systems in areas where sensitive or classif... | |
| ISM-0435 | ISM-0435 requires personnel to receive any necessary briefings before being granted access to systems and their resources | |
| ISM-0610 | ISM-0610 requires users to be trained on the secure use of Cross Domain Solutions (CDSs) before access is granted | |
| ISM-0612 | ISM-0612 requires that system administrators for gateways are formally trained on the operation and management of those gateways | |
| ISM-0817 | Annex A 6.3 requires organisations to deliver information security awareness and training appropriate to roles, including behavioural exp... | |
| ISM-0821 | Annex A 6.3 requires role-relevant information security awareness and regular updates to policies and procedures | |
| ISM-0824 | ISM-0824 advises personnel not to send or receive files via unauthorised online file services | |
| ISM-1083 | Annex A 6.3 requires role-appropriate awareness and regular updates to information security policy and topic-specific procedures | |
| ISM-1146 | ISM-1146 advises personnel to maintain separate work and personal online accounts for online services | |
| ISM-1298 | ISM-1298 requires that personnel are advised of privacy and security risks when travelling overseas with mobile devices | |
| ISM-1565 | ISM-1565 requires annual, role-tailored training for all personnel holding privileged access so elevated rights are used safely | |
| ISM-1740 | Annex A 6.3 requires an organisation-wide, role-appropriate security awareness and training program with regular updates to relevant poli... | |
| ISM-2002 | ISM-2002 requires the board of directors or executive committee to maintain enough cyber security literacy to meet its fiduciary duties a... | |
| ISM-2022 | ISM-2022 requires an organisation to develop, implement and maintain a cyber security awareness training register to record all awareness... | |
| ISM-2037 | ISM-2037 requires that software developers who lack sufficient cyber security knowledge and skills undertake suitable training in secure ... | |
| ISM-2071 | Annex A 6.3 requires the organisation to provide role-relevant information security awareness, education, and training with regular polic... | |
| ISM-2104 | ISM-2104 provides a specific piece of security guidance: do not post security clearance and briefing details online and report if it occurs | |
| ISM-2105 | ISM-2105 requires personnel to be advised to limit posting work-related duties on unauthorised online services and to report cases where ... | |
| ISM-2106 | ISM-2106 requires personnel to be advised to limit posting work-related skills and experience on unauthorised online services and to repo... | |
| ISM-2107 | ISM-2107 encourages personnel to actively configure privacy settings on online services to restrict who can view personal information the... | |
layersPartially meets(1)expand_less | ||
| ISM-1644 | ISM-1644 addresses operational behaviour to prevent inadvertent disclosure during conversations in public areas | |
sync_altPartially overlaps(5)expand_less | ||
| ISM-0252 | Annex A 6.3 requires personnel and relevant interested parties to receive appropriate information security awareness, education, and trai... | |
| ISM-1554 | ISM-1554 requires personnel travelling to high or extreme risk countries to follow specific behaviours (use dedicated work devices/accoun... | |
| ISM-1602 | ISM-1602 requires cyber security documentation and changes to be communicated to all stakeholders | |
| ISM-2035 | ISM-2035 requires security roles, responsibilities and knowledge requirements to be identified and documented to support the software dev... | |
| ISM-2121 | ISM-2121 requires organisations to avoid using developers who lack sufficient cyber security knowledge and skills for the work they are a... | |
handshakeSupports(3)expand_less | ||
| ISM-1864 | ISM-1864 requires a system usage policy to be created and maintained to define expected system use | |
| ISM-2004 | Annex A 6.3 requires organisations to provide appropriate awareness, education and training with regular policy and procedure updates rel... | |
| ISM-2038 | ISM-2038 requires organisations to implement and maintain a register of software developers' cyber security knowledge and skills | |
extensionDepends on(2)expand_less | ||
| ISM-0720 | ISM-0720 requires the CISO to oversee a cyber security communications strategy that communicates the organisation's cyber security vision... | |
| ISM-0735 | ISM-0735 requires the CISO to oversee the development, implementation and maintenance of the organisation's cyber security awareness trai... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in People controls
Annex A 6.8
Mechanisms for Reporting Security Events
Annex A 6.1
Personnel Background Verification
Annex A 6.2
Terms and conditions of employment for security
Annex A 6.4
Disciplinary Process for Information Security Violations
Annex A 6.5
Responsibilities after employment termination or role change
Annex A 6.6
Confidentiality and Non-disclosure Agreements
See all People controls controls, or browse the full ISO 27001 Annex A library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.