ISO 27001 Annex A 6.3 Information Security Awareness, Education and Training is an ISO 27001 control that wants you to educate people on information security.
In this guide you will learn how to implement ISO 27001 Annex A 6.3 and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
Table of contents
Purpose & Definition
The purpose of ISO 27001 Annex A 6.3 is to ensure that people are aware of their responsibilities for information security and that they meet them.
ISO 27001 defines ISO 27001 Information Security Awareness, Education, and Training as:
Personnel of the organisation and relevant interested parties should receive appropriate information security awareness, education and training and regular updates of the organisations information security policy, topic-specific policies and procedures, as relevant for their job function.
ISO 27001:2022 Annex A 6.3 Information Security Awareness, Education and Training
White Label
ISO 27001 for Consultants
Custom-brandable ISO 27001 documentation for consultants. Easily rebrand, reduce project time, and deliver professional, high-value security systems. Focus on delivery, not drafting.
ISO 27001 Annex A 6.3 Training Video
In this free training video you will learn How to implement ISO 27001 Annex A 6.3 Information Security Training and Awareness and Pass Your Audit.
Implementation Guide
General Guidance
You are going to have to
- decide what information security training and awareness to do based on organisation risk and needs
- plan your training and awareness for the next 12 months
- develop, build and implement your training and awareness materials
- deliver your training and awareness to those that need it
- verify that people understand it
- keep records of all training and awareness
The headline guidance is to train people on information security. For more guidance on the ISO 27001 Security Training Policy and guidance on what and how to implement you can read our beginners guide to information security awareness and training.
Training and awareness plan
You are going to put in place and plan for information security training. It is not that hard to do but you want to think about what people will need to know about and how you are going to communicate that. A great tool to help is the ISO 27001 communication plan. You will also consider an off the shelf training tool to help you.
ISO 27001 training requirements
The programme should consider your ISO 27001 policies. That is the main information security policy and any ISO 27001 topic specific policies. It should also include your processes and procedures, specifically around information security.
The list to consider including:
- Leadership and management commitment to information security – it is top down after all
- Requirements of relevant laws and regulations
- People’s own accountability and responsibility for information security
- How to report an event of incident
- Where the information security policies are
- Who you speak to if you have a question on information security
When to do information security awareness and training
The guidance is periodically but the best approach is
- conduct annual awareness training in information security
- conduct annual awareness training in data protection
- conduct initial awareness training either pre employment or as part of the onboarding process
- as things change or new things are introduced make people aware and train them
- in response to incidents and as part of continual improvement you may require additional training or awareness
Approaches to information security training
Actual training is something you implement based on need. You identify who needs training and provide it to them. Some training is for everyone, and some training is a little more targeted and specific to certain people and roles.
It is good practice to consider different types of training, such as emails, web pages, stand up meetings, classroom based but most people opt for an off the shelf training package that makes most of the problem go away.
There is a requirement to verify understanding that most people interpret as taking a test of some sort. These are usually built into the off the shelf training packages.
How to implement ISO 27001 Annex A 6.3
Implementing ISO 27001 Annex A 6.3 requires more than a simple annual slideshow; it demands a structured, multi-layered approach to human risk management.
1. Formalise the Security Awareness Strategy and Plan
Develop a documented roadmap that defines the objectives, target audiences, and delivery methods for the annual training cycle.
- Identify different user groups, such as general staff, C-suite executives, and technical personnel (e.g., DevOps or Database Admins).
- Define specific learning objectives for each group based on the results of your Physical Security Risk Assessment and Threat Landscape.
- Set a training schedule that includes initial inductions for new starters and regular refresher intervals for existing staff.
- Select appropriate delivery channels, such as a Learning Management System (LMS), live webinars, or simulated phishing exercises.
2. Provision Role-Based Training Content
Customise education materials to address the unique technical risks and IAM roles associated with different departments.
- Deliver general awareness on phishing, social engineering, and password hygiene (including MFA usage) for all staff.
- Provision specialised modules for technical teams covering secure coding (OWASP Top 10) and secure system administration.
- Educate management on their specific responsibilities regarding incident reporting and the Disciplinary Process for security breaches.
- Ensure all content reflects current UK data protection legislation, such as the Data Protection Act 2018 and UK GDPR.
3. Execute Simulated Threat Exercises
Implement practical testing scenarios to validate that theoretical training is being applied in real-world situations.
- Launch periodic, non-punitive phishing simulations to measure staff detection and reporting rates.
- Conduct physical security tests, such as “tailgating” checks at secure entry points, to assess adherence to Annex A 7.2 controls.
- Use the results of these exercises to identify “high-risk” individuals or departments that require targeted remedial education.
4. Socialise Security through Continuous Awareness Campaigns
Maintain top-of-mind awareness through frequent, low-friction communications that supplement formal training sessions.
- Distribute monthly newsletters or security advisories highlighting new emerging threats or “Zero Day” vulnerabilities.
- Utilise internal communication channels (e.g., Slack or Teams) to share quick security tips and “Hero of the Month” recognitions for reporting incidents.
- Display physical or digital posters in secure zones to reinforce clear desk and clear screen policies.
5. Formalise Attendance Tracking and Understanding Verification
Establish a verifiable audit trail that demonstrates to external auditors that all personnel have completed and understood their training.
- Utilise an LMS to automate the tracking of completion dates and generate individual training certificates.
- Include mandatory quizzes or assessments at the end of each module to verify the “Education” element of the control.
- Capture formal acknowledgements of the Information Security Policy (ISP) as part of the training workflow.
- Maintain a centralised Training Matrix that maps personnel to their completed modules for easy auditor inspection.
6. Audit Training Effectiveness and Optimise
Review performance metrics annually to ensure the training program remains effective and aligned with the ISMS goals.
- Compare training completion rates against the number of security incidents caused by human error.
- Update training modules based on findings from internal audits or changes in the organisational risk profile.
- Present awareness metrics to the management review board as evidence of continual improvement within the ISMS.
How to pass the audit
To comply with ISO 27001 Annex A 6.3 you are going to implement the ‘how’ to the ‘what’ the control is expecting. In short measure you are going to:
- Consider a specialist training tool
- Write, sign off, implement and communicate your information security awareness plan
- Write, sign off, implement and communicate your information security security plan
- Implement your training and awareness that includes the consequences of violating policies and procedures
- Implement your communication plan to communicate to relevant and interested parties
- Ensure that the training and awareness process meets all laws as well as local laws and regulations
- Keep records of all training and awareness as evidence
- Consider the ISO 27001 competency matrix to ensure you have the required skills for information security
- Implement a process of internal audit that checks that the appropriate controls are in place and effective and where they are not follow the continual improvement process to address the risks
What the auditor will check
The audit is going to check a number of areas for compliance with Annex A 6.3. Lets go through them
1. That you have done information security training and awareness
The auditor will meet with the HR and those responsible for training and awareness and check that it there is a plan and that you are following that plan. The easiest way to do this is get a specialist training tool but you can do it manually. Just be sure to be able to evidence that it happened, people understood it and you have records. They will check this training for things like annual training on Data Protection and Information Security and look at the onboarding process to see how you address it for new hires.
2. That you have communicated the training and awareness process
The process needs to be communicated to relevant and interested parties. The audit will check that the training and awareness plan and the communication plan and look for past evidence that this has happened.
3. That people are aware of their responsibilities
The audit is going to check for documented processes, documented topic specific policy and these have been communicated and people have been trained on what is required of them.
Top 3 mistakes and how to avoid them
In my experience, the top 3 mistakes people make for ISO 27001 Information Security Awareness Education and Training are
1. You have no evidence that anything actually happened
You need to keep records and minutes of everything. You need a paper trail to show it was done. Make sure you have updated communication plans and training plans and you can evidence that it took place. If it isn’t written down it didn’t happen.
2. One or more members of your team haven’t done what they should have done
Prior to the audit check that all members of the team have done what they should have. Do they know where the process documents are in relation to the training and awareness process? Has everyone done the training they should have done in the time they should have done it? Is the communication plan up to date with evidence that communications on awareness have taken place. Do a pre audit as close to the audit as you can that checks the training and awareness process and the HR team that will be involved. Assuming they are doing the right thing is a recipe for disaster. Check!
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 6.3 FAQ
ISO 27001 requires that security awareness training is conducted at regular intervals, which is universally interpreted by auditors as at least annually or when significant changes occur.
Annual training is the minimum requirement for most certification bodies.
Immediate “refresher” sessions should occur following a security incident or policy change.
Ongoing awareness campaigns (e.g., monthly newsletters) should supplement formal training.
New starters must receive training as part of their initial onboarding induction.
Yes, ISO 27001 Annex A 6.3 makes security awareness training mandatory for every individual working under the organisation’s control, regardless of their seniority.
Executive leadership must participate to demonstrate a “Tone at the Top” culture.
Contractors and freelancers must be included if they access sensitive systems.
Technical teams require additional, specialised training (e.g., secure coding).
General staff focus on common threats like phishing and physical security.
Training must cover the organisation’s specific security policies, legal requirements, and common technical threats relevant to the user’s role.
Phishing awareness and social engineering defence.
Password management and Multi-Factor Authentication (MFA) usage.
Physical security protocols and clear desk/clear screen policies.
Procedures for reporting security events and suspected weaknesses.
Auditors require verifiable evidence that training was delivered, understood, and attended by the relevant personnel.
Attendance logs or digital certificates from a Learning Management System (LMS).
Quiz scores or assessment results to prove the “Education” element was successful.
Signed acknowledgements of the Information Security Policy (ISP).
Samples of awareness materials such as internal posters or email campaigns.
ISO 27001 distinguishes between these three to ensure a holistic approach to the human element of information security.
Awareness: High-level reminders of security threats (e.g., posters or newsletters).
Training: Formal instruction on how to perform specific tasks safely (e.g., using a VPN).
Education: Deeper learning to understand the “why” behind security controls and risks.
Related ISO 27001 Controls
ISO 27001 Annex A 6.3 Attributes Table
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability Confidentiality Integrity | Protect | Human resource security | Governance and ecosystem |
Stuart Barker
ISO 27001 Ninja
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.
- MSc Security
- ISO 27001 Lead Auditor
- 30+ Years Exp
- Ex-GE Leader