The Ultimate Guide to ISO 27001:2022 Clause 7.2: Competence

ISO 27001 Competence

ISO 27001 Competence is the requirement that the people working on the information security management systems have the relevant skills and experience to do so effectively.

In ISO 27001 this is known as ISO27001:2022 Clause 7.2 Competence. It is one of the mandatory ISO 27001 clauses.

To run an information security management system you must have people with the competence to do so. This means having the skills and experience required.

Key Takeaways

• Mandatory Requirement: The clause is a mandatory requirement that ensures personnel working on the information security management system (ISMS) have the necessary skills and experience.
• Implementation: Organisations must engage with trained ISO 27001 resources, assign roles and responsibilities, and identify the required information security skills.
• Auditor’s Focus: Auditors will verify compliance by checking for documented roles, evidence of competence (e.g., a competency matrix), and training plans to address any gaps.
• Common Mistakes: The most frequent errors include not having anyone with ISO 27001 experience, failing to document roles, and neglecting to create training plans to maintain competence.

What is ISO 27001 Clause 7.2 and Why is it Important?

ISO 27001 competence is ensuring you have the skills and experience to run the information security management system.

What is does it mean? It means you have people on the team when we’re running your information security management system (ISMS) that know how to run the management system.

This clause is all about people and their skills, experience and competency.

You cannot have ISO 27001 and go for certification if nobody knows any anything about ISO 27001, they’ve got no experience in ISO 27001 and they’ve got no knowledge in ISO 27001.

Purpose and Definition

The purpose of ISO 27001 Clause 7.2 Competence is to make sure that the people you have working on the information security management system (ISMS) have the skills, knowledge and experience to do it.

The ISO 27001 standard defines ISO Clause 7.2 Competence as:

The organisation shall:
a) determine the necessary competence of person(s) doing work under its control that affects its information security performance;
b) ensure that these persons are competent on the basis of appropriate education, training, or experience;
c) where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken; and
d) retain appropriate documented information as evidence of competence.

ISO 27001:2022 Clause 7.2 Competence

ISO 27001 Clause 7.2 Requirement

The requirement for ISO 27001 Competence far out reaches just information security.

The organisation as a whole has departments that contribute to the success of the organisation that also play into an effective information security management system.

We can consider HR, legal and regulatory compliance, commercial, and Information Technology (IT) teams.

There are distinct phases in the process of ISO 27001 certification. Each of those phases potentially requires a different level of skill, knowledge and experience. It is possible that this is one person but the likelihood is you are going to get specialist help for the establishment and implementation phase. It can make sense to reduce the reliance on that specialist help when it comes to maintenance and continual improvement. Only using that knowledge and expertise for training and sense checking.

ISO 27001 Clause 7.2 Explained: A Complete Guide

In the ISO 27001 tutorial How to implement ISO 27001 Clause 7.2 Competence I show you how to implement it and how to pass the audit.

How to implement ISO 27001 Clause 7.2: Step-By-Step

ISO 27001 Clause 7.2 is a crucial part of an Information Security Management System (ISMS), focusing on the competence of people working under the organisation’s control. While Clause 7.1 deals with resources, Clause 7.2 specifically addresses the skills, knowledge, and experience needed to protect information assets. Implementing this clause is not just a box-ticking exercise; it’s about building a robust and knowledgeable security culture. This step-by-step guide will walk you through the essential actions to ensure all personnel are competent to perform their duties and contribute effectively to the ISMS.

How can an ISO 27001 Toolkit help with ISO 27001 Clause 7.3?

For ISO 27001 Clause 7.2 Competence the entire ISO 27001 toolkit is relevant but in particular the following templates directly support this ISO 27001 clause:

ISO 27001 Competency Matrix Template

The ISO 27001 competency matrix template is used to record the employees and the skills that they have, the skills they require and any training needs. It is directly supports clause 7.2 and is a key document to meeting it.

ISO 27001 Accountability Template

The ISO 27001 accountability template records which employees are accountable and responsible for the information security management system and all of the ISO 27001 Annex A controls. It is a key document in identifying and recording who is doing what and is used along with the competency matrix to record the skills and experience they have for the areas that they have been assigned.

ISO 27001 Training Policy Template

The ISO 27001 training policy template is a supporting document that sets out the organisations approach to training and commitment to ensuring employees have the skills and experience that they need to perform the roles that they have been assigned to.

The Role of External Consultants and Outsourcing

It can be useful to rely on the competence of third parties. If you engage with third parties and consultants then this is a fast track to the evidence of competence for the areas that they cover.

How to build your own competence matrix

This particular video on How to Build a Competency Matrix has been viewed over 24,000 times and in it we show you how to build the competency matrix from scratch if you don’t want to download and use the ISO 27001 Competence Matrix Template.

How to audit ISO 27001 clause 7.2

This audit checklist is a guide on how to conduct an internal audit of ISO 27001clause 7.2 competence based on what the ISO 27001 certification auditor will audit. It gives practical audit tips including what to audit and how.

1. Review Competency Requirements

Verify the organisation has identified the necessary competencies for ISMS-related roles.

Audit Techniques: Document review (job descriptions, role profiles, competency frameworks), interviews with management and HR personnel, analysis of ISMS activities and their required skills.

2. Assess Competence Levels

Ensure that competence levels are defined for each required competency.

• Document review (competency frameworks, skills matrices), interviews with subject matter experts, analysis of competence level descriptions for clarity and measurability.

3. Evaluate Competence Assessment Methods

Verify that appropriate methods are used to assess the current competence of personnel.

• Review of assessment procedures (self-assessments, peer reviews, manager evaluations, skills tests), interviews with HR and training personnel, observation of assessment activities.

4. Examine Training and Development Plans

Ensure that plans are in place to address identified competence gaps.

• Document review (training plans, development programs), interviews with training personnel and managers, analysis of training needs assessments.

5. Assess Training Effectiveness

Verify that the effectiveness of training and development activities is evaluated.

• Review of training evaluation methods (post-training quizzes, on-the-job observations, performance reviews), interviews with trainees and their managers, analysis of training feedback and performance data.

6. Evaluate Competence Maintenance

Ensure that personnel maintain their competence over time.

• Review of continuous learning and professional development programs, interviews with employees and their managers, examination of certification renewal and recertification records.

7. Examine Competence Records

Verify that records of personnel competence, training, and development activities are maintained.

• Document review (training records, competency assessments, performance reviews), interviews with HR personnel, inspection of training management systems and databases.

8. Assess Competence Review Process

Ensure that competence requirements are regularly reviewed.

• Review of competence review procedures, interviews with management and HR personnel, analysis of changes in ISMS requirements and their impact on competency needs.

9. Evaluate Training Resources

Verify that adequate resources are available to support training and development activities.

• Interviews with training personnel and budget holders, review of training budgets and resource allocation plans, examination of training facilities and equipment.

10. Assess Promotion of Learning Culture

Verify that the organization promotes a culture of continuous learning and development.

• Interviews with employees at different levels, review of communication materials related to training and development, analysis of employee engagement in learning activities, examination of reward and recognition programs related to skills development.

How to pass the ISO 27001 Clause 7.2 audit

To pass an audit of ISO 27001 Clause 7.2 Competence you are going to

• Understand the requirements of ISO 27001 Competence
• Identify the roles you need
• Allocate people to roles
• Assess the competency of people to perform those roles
• Address competency gaps through training or bringing in specialist help

What an auditor looks for

The audit is going to check a number of areas for compliance with ISO 27001 Clause 7.2 Competence. Lets go through them

1. Roles are documented and assigned

The first step is to document the roles that make up the information security management system and to allocates those roles. The auditor is going to look for documented roles and for you to demonstrate that people are assigned to those roles.

2. That Competence of People is Documented

The roles are that are document and assigned must be assigned to people that are competent to perform the role so the auditor is going to look for documented evidence of competence. This is where the competency matrix comes in. If you do not have competence, documenting that and showing your plan to fill the competence gap is key.

Top 3 ISO 27001 Clause 7.2 Mistakes and How to Fix Them

In my experience, the top 3 mistakes people make for ISO 27001 clause 7.2 are

1. You do not have anyone with experience in ISO 27001

The number 1 mistake is that you do not have anyone with any experience of ISO 27001. This is more common than you might imagine. To run and ISO 27001 Information Security Management System you are going to need training and / or experience of ISO 27001.

2. You did not document and assign roles

There are mandatory roles as part of your ISO 27001 implementation and the roles need documenting and assigning to people. A common mistake is not to document those roles or to formally assign them. We see this being given to someone in IT to manage without consideration for the wider roles that are required for an effective management system.

3. You have no training plans

As ISO 27001 is based on continual improvement we see that the auditor will look at the training plans and want to see evidence that competence is maintained. This is usually in the form at looking that the plans for the coming 12 months to see if any competence gaps or ongoing training requirements have been considered and documented.

ISO 27001 Clause 7.2: Competence FAQ

Related ISO 27001 Controls

ISO 27001 Annex A 8.32: Change Management

ISO 27001 Annex A 5.4: Management Responsibilities

Further Reading

ISO 27001 Competency Matrix Beginner’s Guide