ISO 27001 Clause 7.2 Competence

In this ultimate guide to ISO 27001 Clause 7.2 Competence you will learn

• What is ISO 27001 Clause 7.2 
• How to implement ISO 27001 Clause 7.2
• How to build a competency matrix

I am Stuart Barker, the ISO 27001 Ninja and author of the Ultimate ISO 27001 Toolkit.

With over 30 years industry experience I will show you what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it for ISO 27001 certification.

What is ISO 27001 Clause 7.2?

To run an information security management system you must have people with the competence to do so. This means having the skills and experience required.

ISO 27001 Clause 7.2 is an ISO 27001 control that requires an organisation to have people that are competent to do the work for information security.

This clause is all about people and their skills, experience and competency.

The ISO 27001 standard for ISO 27001 certification wants you to have the right people with the right skills for running ISO 27001.

ISO 27001 Clause 7.2 Purpose

The purpose of ISO 27001 Clause 7.2 is to make sure that the people you have working on the information security management system (ISMS) have the skills, knowledge and experience to do it.

ISO 27001 Clause 7.2 Definition

The ISO 27001 Standard defines ISO 27001 Clause 7.2 as:

The organisation shall:
a) determine the necessary competence of person(s) doing work under its control that affects its information security performance;
b) ensure that these persons are competent on the basis of appropriate education, training, or experience;
c) where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken; and
d) retain appropriate documented information as evidence of competence.

ISO 27001:2022 Clause 7.2 Competence

ISO 27001 Clause 7.2 Requirement

The requirement for ISO 27001 Competence far out reaches just information security.

The organisation as a whole has departments that contribute to the success of the organisation that also play into an effective information security management system.

We can consider HR, legal and regulatory compliance, commercial, and Information Technology (IT) teams.

There are distinct phases in the process of ISO 27001 certification. Each of those phases potentially requires a different level of skill, knowledge and experience. It is possible that this is one person but the likelihood is you are going to get specialist help for the establishment and implementation phase. It can make sense to reduce the reliance on that specialist help when it comes to maintenance and continual improvement. Only using that knowledge and expertise for training and sense checking.

How to Implement ISO 27001 Clause 7.2

Engage with trained ISO 27001 resources

Whether you look to engage a professional such as a High Table ISO 27001 Consultant, hire someone full-time or train up internal staff on ISO 27001 lead auditor or ISO 27001 lead implementor courses you need to engage with trained and experienced resource for your ISO 27001 certification.

Decide which resources to use when

To implement ISO 27001 Clause 7.2 you want to choose the correct resource for the correct phase of your information security management system (ISMS) lifecycle. This will ensure you have the correct competence when you need it.

Our guide would be

ISO 27001 Establishment: use specialist resource

ISO 27001 Implementation: use specialist resource

ISO 27001 Certification: use specialist resource in combination with your own staff

ISO 27001 Maintenance: use your own staff with training and sense checking by specialist resource

ISO 27001 Continual Improvement: use your own staff with training and sense checking by specialist resource

Complete an accountability matrix

For each of the ISO 27001 clauses AND the ISO 27001 Annex A / ISO 27002 clauses you need to allocate and record who is responsible for that clause and control.

Complete a competency matrix

For each person involved in the operation of the Information Security Management System be sure to record them in them in the competency matrix. The competency matrix allows you to identify and demonstrate that you have the required competencies to run the information security management system. It also identifies gaps that you can plan to address.

Train People

ISO 27001 training can help you gain the skills and experience in house and is an option to consider.

ISO 27001 lead auditor training, ISO 27001 lead implementor training and associated courses are readily available to choose from. For book knowledge to the standard these are an ideal starting point. It can be problematic when it comes to actually applying the learnings though as they tend to focus heavily on the semantics of the standard rather than real world implementation and they will not cover your particular implementation.

Will they tick the box when it comes to the ISO 27001 certification? If you haven’t got specialist outside help then yes, they most definitely will.

There is a wealth of training and guidance provided as part of the ISO 27001 Toolkit for free. There are also free resources on the Internet such as this excellent YouTube Channel dedicated to ISO 27001 and showing you how to do it yourself. If we were going to start anywhere we would start with this Essential Step By Step Guide to Implementing ISO 27001.

Of course you can do ALL of it with the ISO 27001 Toolkit which includes all of the resources, step by step guides and video walkthroughs you will need with the ability to by specialist help by the hour.

ISO 27001 Templates

ISO 27001 templates are a great way to fast track your implementation and leverage industry best practice.

These individual templates help meet the specific requirements of ISO 27001 clause 7.2.

ISO 27001 Clause 7.2 YouTube Tutorial

Watch the ISO 27001 Clause 7.2 YouTube tutorial How to implement ISO 27001 Clause 7.2 Competence

How do you demonstrate compliance to ISO 27001 clause 7.2?

To comply with ISO 27001 Clause 7.2 require you need to document, record and evidence competence. But in what? And how?

The most straightforward way is to create a competency matrix, populate it and keep it up to date.

We provide an excellent overview of the competency matrix and how to create one as well as a video guide in our blog: ISO 27001 Competence Matrix Ultimate Guide with Template

There is no set level to what level of competence that you require. It is dependant on the needs of the business. You can easily argue what ever level you decide based on the fact that you have risk assessed it and determined it based on risk and business need.

Of course the simplest way is to demonstrate training and certifications for staff.

If this is cost prohibitive then the use of outsourced third parties can also be an answer.

Depending on the size of the business it is unlikely you will have in house legal counsel. So how do you demonstrate that you have competence? Well you probably outsource your legal requirements to a third party law firm. As long as you have a contract and can evidence it then you can demonstrate your competence compliance by simply outsourcing the function. GDPR and Data Protection outside of your grasp for a full time employee? Of course it is. So outsource it and engage a third party company, have a contract in place and record that in your competency matrix.

It isn’t complicated or hard and it doesn’t have to be costly.

How to build your own competence matrix

This particular video on How to Build a Competency Matrix has been viewed over 10,000 times and in it we show you how to build the competency matrix from scratch if you don’t want to download and use the ISO 27001 Competence Matrix Template.

How to pass an audit of ISO 27001 Clause 7.2

To pass an audit of ISO 27001 Clause 7.2 you are going to

• Understand the requirements of ISO 27001 Clause 7.2
• Identify the roles you need
• Allocate people to roles
• Assess the competency of people to perform those roles
• Address competency gaps through training or bringing in specialist help

What the auditor will check

The audit is going to check a number of areas for compliance with Clause 7.2. Lets go through them

1. Roles are documented and assigned

The first step is to document the roles that make up the information security management system and to allocates those roles. The auditor is going to look for documented roles and for you to demonstrate that people are assigned to those roles.

2. That Competence of People is Documented

The roles are that are document and assigned must be assigned to people that are competent to perform the role so the auditor is going to look for documented evidence of competence. This is where the competency matrix comes in. If you do not have competence, documenting that and showing your plan to fill the competence gap is key.

Top 3 Mistakes People Make

In my experience, the top 3 mistakes people make for ISO 27001 clause 7.2 are

1. You do not have anyone with experience in ISO 27001

The number 1 mistake is that you do not have anyone with any experience of ISO 27001. This is more common than you might imagine. To run and ISO 27001 Information Security Management System you are going to need training and / or experience of ISO 27001.

2. You did not document and assign roles

There are mandatory roles as part of your ISO 27001 implementation and the roles need documenting and assigning to people. A common mistake is not to document those roles or to formally assign them. We see this being given to someone in IT to manage without consideration for the wider roles that are required for an effective management system.

3. You have no training plans

As ISO 27001 is based on continual improvement we see that the auditor will look at the training plans and want to see evidence that competence is maintained. This is usually in the form at looking that the plans for the coming 12 months to see if any competence gaps or ongoing training requirements have been considered and documented.

ISO 27001 Clause 7.2 FAQ