You cannot achieve ISO 27001 certification if your team lacks the necessary expertise. It is that simple. ISO 27001 Clause 7.2, the “Competence” clause, is a mandatory requirement ensuring the people managing your information security possess the right skills, knowledge, and experience. This isn’t just about ticking a box; it’s about building a team capable of protecting your organisation.
To succeed, you must “play the auditor, not the standard.” This means focusing on the practical evidence an auditor needs to see. This guide provides a step-by-step roadmap to demystify Clause 7.2, create required evidence, and build a resilient security culture.
Table of contents
Key Takeaways for ISO 27001 Competence
- Mandatory Requirement: Clause 7.2 is non-negotiable for anyone seeking ISO 27001 certification.
- Core Implementation: You must formally assign security roles, identify necessary skills, and document everything in a competency matrix.
- Auditor Focus: External auditors demand tangible proof, including documented roles and clear plans to address skill gaps.
- Common Pitfalls: Avoid the mistake of having no ISO 27001 experience on your team or failing to maintain a forward-looking training plan.
Understanding the ISO 27001:2022 Clause 7.2 Requirements
According to the official ISO 27001:2022 standard, the organisation shall:
- Determine the necessary competence of person(s) doing work under its control that affects its information security performance.
- Ensure that these persons are competent on the basis of appropriate education, training, or experience.
- Where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken.
- Retain appropriate documented information as evidence of competence.
What This Means in Plain English:
- Part (a): Identify the specific skills and experience needed for every role impacting information security.
- Part (b): Confirm that people in these roles meet your defined criteria through education, training, or hands-on experience.
- Part (c): If a “skill gap” exists, you must fix it (via training or hiring) and then verify that the fix actually worked.
- Part (d): Keep records. If it isn’t documented, an auditor will assume it never happened.
Step-by-Step Guide to Implementing Clause 7.2
1. Secure the Right Expertise
You must have access to proven ISO 27001 experience. You can engage a consultant, hire a full-time expert, or invest in ISO 27001 Lead Implementer or Lead Auditor certifications for your internal staff.
2. Assign Roles and Responsibilities
Formally document ISMS roles. This links directly to Clause 7.1 (Resources). Create an accountability matrix defining who is responsible for each part of the ISMS and Annex A controls.
3. Identify Required Security Skills
Document the specific skills your organisation needs. Common industry benchmarks include:
- ISO 27001 Lead Auditor / Lead Implementer (The most direct evidence)
- CISSP (Certified Information Systems Security Professional)
- CISM (Certified Information Security Manager)
- GDPR / Data Protection expertise
- Technical qualifications (e.g., AWS Security, Network Security)
4. Document Everything in a Competency Matrix
The competency matrix is your central piece of evidence. This spreadsheet records your personnel, their roles, their current skills, and any identified gaps.
5. Address Competence Gaps
When the matrix reveals a gap, you must take documented action: provide training, offer mentoring, or reassign roles to more qualified individuals.
6. Retain Evidence of Competence
Maintain a central file for each person with ISMS responsibilities. This should include training certificates, course records, and updated CVs. For small businesses, an outsourced contract (e.g., for legal or DPO services) serves as valid evidence of competence.
Top 3 Mistakes to Avoid
- Lacking ISO 27001 Experience: Attempting implementation without anyone trained in the specific standard is the fastest way to fail an audit.
- Informal Role Assignment: Auditors hate ad-hoc structures. Ensure every role—from leadership to IT—is formally assigned.
- No Forward-Looking Training Plan: Competence is an ongoing process. You must show a plan for the next 12 months to address emerging threats.
How to Pass Your ISO 27001 Audit for Clause 7.2
An auditor’s review is straightforward and evidence-based. They will focus on:
- Documented Roles: Verification that roles are defined and assigned.
- Evidence of Competence: A review of your competency matrix and supporting documents like certificates and CVs.
Frequently Asked Questions (FAQ)
What is the difference between “competence” and “awareness”?
Competence (Clause 7.2) refers to specific, role-based skills needed to do a job. Awareness (Clause 7.3) is a general requirement for all staff to understand security policies and their general responsibilities.
Does experience count as competence?
Yes. The standard explicitly accepts “education, training, or experience.” Hands-on experience is often more valuable to an auditor than a certificate alone.
What is a competency matrix?
It is a tool (usually a spreadsheet) used to map roles against required skills. While the name isn’t in the standard, it is the industry-recognised best practice for proving compliance.
Are there changes in the ISO 27001:2022 version?
No, the requirements for Clause 7.2 remain the same in the 2022 revision as they were in 2013.
Conclusion: Competence is a Continuous Journey
Implementing ISO 27001 Clause 7.2 is a strategic imperative. By defining roles, identifying skills, and maintaining a competency matrix, you create an auditable trail of due diligence. A well-managed approach to competence doesn’t just satisfy an auditor; it builds a more resilient organisation.
About the author
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management.
Holding an MSc in Software and Systems Security, Stuart combines academic rigor with extensive operational experience. His background includes over a decade leading Data Governance for General Electric (GE) across Europe, as well as founding and exiting a successful cyber security consultancy.
As a qualified ISO 27001 Lead Auditor and Lead Implementer, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. He has successfully guided hundreds of organizations – from high-growth technology startups to enterprise financial institutions – through the audit lifecycle.
His toolkits represents the distillation of that field experience into a standardised framework. They move beyond theoretical compliance, providing a pragmatic, auditor-verified methodology designed to satisfy ISO/IEC 27001:2022 while minimising operational friction.
