ISO 27001:2022 Clause 7.2 Competence for AI Companies

ISO 27001 Clause 7.2 is a security control that mandates the determination and verification of personnel competence for roles affecting information security performance. This requirement ensures the Business Benefit of establishing a highly skilled workforce capable of securing critical AI model weights, training data, and production pipelines against emerging threats.

Look, your AI company is likely burning cash on H100s and trying to outrun the competition. You are shipping code and training models at a rate that would make a traditional corporate IT manager faint. But in the cold light of an audit, your “groundbreaking” neural network is just another asset that needs protecting. If your team doesn’t know how to secure your weights, your data, or your pipelines, you are not an innovator: you are a liability.

ISO 27001 Clause 7.2 (Competence) is about making sure the people holding the keys to the castle actually know how the locks work. For an AI startup, your people are your primary security control. If they are incompetent, your security is a house of cards. This guide is the gold standard for AI companies that want to stop treating compliance like a paperwork exercise and start building a team that can actually defend the business.

1. The “No-BS” Translation: Decoding Clause 7.2

The official standard says: “The organisation shall determine the necessary competence of person(s) doing work under its control that affects its information security performance.”

The Auditor’s View: I want proof that you’ve identified what skills your team needs to keep the ISMS alive, and that you haven’t just hired your cousin’s mate who “knows a bit about computers” to run your AWS security.

The AI Company View: This means Dave the DevOps engineer needs to know how to lock down an S3 bucket and rotate API keys, not just how to prompt an LLM. If your team thinks security is “someone else’s problem” or relies on a dashboard to tell them they are safe, you are going to get pwned. You need to identify the skills, check the team has them, and keep the receipts for the training you’ve paid for.

---

2. The Business Case: Why This Actually Matters

Compliance is boring until it stops you from closing a seven-figure deal. For AI companies, Competence is a revenue enabler.

• The Sales Angle: Enterprise clients (Banks, Pharma, Govt) will grill you on your team’s background. They will ask: “How do I know your engineers won’t accidentally leak my training data to a public repo?” If your answer is “we have a SaaS platform for that,” they will walk away. They want to see a Competency Matrix showing that your lead engineers are security-aware.
• The Risk Angle: Without competent staff, someone will eventually leave a GitHub Token in a public Gist. Your model weights will be on a torrent site by morning. Clause 7.2 is the preventative control against “Stupid Employee Syndrome,” which is the leading cause of data breaches.
• Vendor Bankruptcy: If you rely on a SaaS GRC platform to “manage” your competence and they go bust, you lose your records. If you own your files via a toolkit, you are bulletproof.

---

3. Why the ISO 27001 Toolkit Beats SaaS Platforms

Don’t fall for the shiny dashboard trap. SaaS GRC platforms are just expensive digital filing cabinets that you don’t even own.

Feature	ISO 27001 Toolkit (HighTable)	Expensive SaaS GRC Platforms
Ownership	You keep your files forever: you don’t rent them.	Stop paying the subscription, and your ISMS is gone.
Simplicity	Uses Word and Excel: no complex training required.	Weeks of training just to navigate a proprietary UI.
Cost	One-off fee: affordable for lean AI startups.	Expensive monthly fees that bleed your runway.
Freedom	No vendor lock-in: you control your data.	Your security posture is hostage to their roadmap.

---

4. DORA, NIS2, and AI Law Alignment

The regulatory landscape is shifting. AI companies are now in the crosshairs of several new laws that make Clause 7.2 mandatory, not just “best practice.”

• DORA (Digital Operational Resilience Act): If you provide AI services to financial institutions, DORA requires your staff to have “professional diligence” and specific ICT security training. Clause 7.2 is your primary evidence for this.
• NIS2: This directive mandates “management body” training. You cannot just delegate security to a junior; your leadership team must prove they are competent in risk management.
• EU AI Act: High-risk AI systems require “human oversight.” That oversight must be performed by competent individuals. Clause 7.2 ensures you have the documentation to prove those people are actually qualified to oversee the model.

---

5. The Evidence Locker: What the Auditor Needs to See

When the auditor walks in, don’t scramble. Have these ready in a folder:

• The Competency Matrix: A CSV or Excel file mapping your team members to specific security skills (e.g., AWS Security, Secure Coding, Data Privacy).
• Signed Job Descriptions: These should explicitly mention security responsibilities. “Building AI” isn’t enough: it must include “Securing the AI lifecycle.”
• Training Records: Certificates for ISO 27001 Lead Auditor, CISSP, or even records of internal workshops where you taught the team about “Prompt Injection” risks.
• Onboarding Checklists: Proof that every new hire was checked for competence before being given access to production servers.

---

6. Top 3 Non-Conformities When Using SaaS Platforms

I have failed companies because they trusted a SaaS platform over their own common sense. Here are the top three traps:

1. The “Ghost” Training NC: The SaaS platform says everyone is “100% compliant” because they clicked a button. The auditor interviews a developer who has no idea what the Information Security Policy says. Major Non-Conformity.
2. The “Stale Matrix” NC: The GRC platform hasn’t been updated since you hired 10 new engineers. The platform shows an old snapshot, but the reality is different. Minor Non-Conformity.
3. The “Inaccessible Records” NC: The auditor asks for a specific certificate, but the platform’s API is down or the document won’t export correctly. If I can’t see the evidence, it doesn’t exist. Minor Non-Conformity.

---

7. Common Pitfalls and Auditor Traps

• The “Copy-Paste” Policy: Using a template and forgetting to change the company name is bad, but claiming your team has “Advanced Cryptography Degrees” when they don’t is an auditor trap. We will check.
• Zero Forward Planning: Clause 7.2 requires you to “take action” to acquire competence. If you identified a gap six months ago and haven’t booked the training, you’ve failed the control.
• The “Shadow IT” Gap: Failing to apply Clause 7.2 to contractors or third-party researchers who have access to your AWS environment. They must be as competent as your staff.

---

8. Handling Exceptions: The “Break Glass” Protocol

Sometimes you need to hire someone fast for a P0 incident who might not have the full ISO vetting yet.

The Emergency Path: In an incident, you can bypass the standard “competence check” for a specialist contractor, provided they are supervised 100% of the time by a “Competent” internal staff member (e.g., the CTO).

The Paper Trail: You must log this exception in your Incident Management System (Linear/Jira). Record who they were, why they were needed, and who supervised them. This keeps the auditor happy while you fix the production fire.

---

9. The Process Layer: Standard Operating Procedure (SOP)

1. Hire: HR gathers CVs and checks for prior security experience.
2. Onboard: New hire completes security awareness training via Slack/Jira.
3. Assess: The Manager reviews the Competency Matrix and tags the new hire’s skills.
4. Gap Fill: If they are a Lead Dev but don’t know AWS security, a “Security” ticket is raised in Linear for a training course.
5. Record: Certificate is saved to the company’s secure storage (not a SaaS platform).

---

10. ISO 27001 Clause 7.2 FAQ

Conclusion: Build a Culture, Not a Dashboard

Clause 7.2 is the difference between an AI company that survives a breach and one that folds. Stop renting your compliance and start investing in your people. Use a proper toolkit, own your files, and prove to the world that your team actually knows what they are doing.

About the author