In this ultimate how to implement guide to ISO 27001 Clause 7.2 Competence, you will learn directly from an ISO 27001 Lead Auditor:
Table of contents
1. Secure the Right Expertise
You must have access to proven ISO 27001 experience. You can engage a consultant, hire a full-time expert, or invest in ISO 27001 Lead Implementer or Lead Auditor certifications for your internal staff.
2. Assign Roles and Responsibilities
Formally document ISMS roles. This links directly to Clause 7.1 (Resources). Create an accountability matrix defining who is responsible for each part of the ISMS and Annex A controls.
3. Identify Required Security Skills
Document the specific skills your organisation needs. Common industry benchmarks include:
- ISO 27001 Lead Auditor / Lead Implementer (The most direct evidence)
- CISSP (Certified Information Systems Security Professional)
- CISM (Certified Information Security Manager)
- GDPR / Data Protection expertise
- Technical qualifications (e.g., AWS Security, Network Security)
4. Document Everything in a Competency Matrix
The competency matrix is your central piece of evidence. This spreadsheet records your personnel, their roles, their current skills, and any identified gaps.
5. Address Competence Gaps
When the matrix reveals a gap, you must take documented action: provide training, offer mentoring, or reassign roles to more qualified individuals.
6. Retain Evidence of Competence
Maintain a central file for each person with ISMS responsibilities. This should include training certificates, course records, and updated CVs. For small businesses, an outsourced contract (e.g., for legal or DPO services) serves as valid evidence of competence.
About the author
