Successfully implementing an Information Security Management System (ISMS) hinges on the capabilities of your people. ISO 27001 Clause 7.2, “Competence,” is a mandatory requirement that ensures the right people with the right skills are managing your information security. While it may sound complex, the core principle is simple: you must prove that your team is qualified for their security-related roles.
This guide provides a practical, 10-point checklist to simplify the implementation of Clause 7.2, demystify the requirements, and prepare your organisation for a successful certification audit.
Table of contents
What is ISO 27001 Clause 7.2 and Why Does It Matter?
Understanding the “why” behind a standard’s requirement is the first step toward effective implementation. Clause 7.2 is not a bureaucratic hurdle; it is a foundational element for building a resilient ISMS. It ensures that individuals tasked with protecting your organisation’s information assets possess the necessary skills and experience to do so effectively.
The Core Principle: People, Skills, and Experience
In simple terms, ISO 27001 Competence is about ensuring that personnel working on your ISMS have the necessary skills, knowledge, and experience. This requirement extends far beyond your core IT or security team. An effective ISMS involves departments such as HR, legal, procurement, and senior management. The standard recognises that a management system is only as strong as the people who operate it. Put bluntly: you cannot achieve ISO 27001 certification if nobody understands the standard.
The Official ISO 27001:2022 Requirement
The ISO 27001:2022 standard provides a clear mandate. The organisation shall:
- Determine the necessary competence of persons doing work under its control that affects information security performance.
- Ensure these persons are competent based on appropriate education, training, or experience.
- Take action (where applicable) to acquire necessary competence and evaluate the effectiveness of those actions.
- Retain documented information as evidence of competence.
The 10-Point Implementation Checklist for Clause 7.2
A structured process is critical for compliance and building a robust security culture. Use this roadmap to ensure nothing is missed when establishing competence for your ISMS.
- Engage Trained ISO 27001 Resources: Secure access to expertise early. Options include hiring an external consultant, recruiting a full-time specialist, or investing in internal staff training through recognised bodies.
- Phase Your Resource Usage: Use specialist resources for the initial “Establishment” and “Certification” phases. Transition to internal staff for “Maintenance” and “Continual Improvement,” using specialists only for periodic audits or sense-checking.
- Assign ISO 27001 Roles and Responsibilities: Formally document ISMS roles. Refer to Clause 7.1 (Resources) to understand which roles are needed before assigning individuals.
- Complete the Accountability Matrix: Create a document (often a RACI matrix) that records who is responsible for each ISO 27001 clause and each Annex A control. This is a primary document auditors expect to see.
- Identify Required Security Skills: Determine the specific skills your context requires. While CISSP or CISM are great, prioritize ISO 27001 Lead Auditor or Lead Implementer qualifications for the standard itself, alongside technical skills like AWS security or network forensics.
- Produce a Competency Matrix: This is your primary evidence. It maps personnel to their relevant skills, qualifications, and experience. It highlights both your strengths and your “competency gaps.”
- Manage Ongoing Competence: Competence is not a one-time event. Track status using categories such as “Trained,” “Experienced,” “Qualified,” or “Training Planned.”
- Retain Evidence of Competence: Maintain a “belts and braces” evidence folder. Collaborate with HR to keep copies of certificates, training logs, attendance records, and professional references.
- Address Legal and Regulatory Competence: For areas like GDPR or niche legal counsel, you can outsource competence. A signed contract with a specialist law firm is acceptable evidence of competence for these functions.
- Implement Targeted Training: Close gaps with formal training. Be aware that while “Lead Auditor” courses satisfy auditors, they focus on the standard’s semantics; supplement these with internal workshops on your specific policies and tools.
Passing Your Audit: What the Auditor Scrutinises
An auditor’s review of Clause 7.2 is methodical and evidence-based. They generally look for two things:
1. Documentation of Roles
The auditor will verify that you have formally defined the roles required for the ISMS. They will look for evidence that specific individuals have been assigned to these roles, ensuring accountability is not merely “implied.”
2. Evidence of Individual Competence
Once roles are confirmed, the auditor will check the Competency Matrix. They aren’t just looking for certificates; they are looking for your process for identifying gaps and your plan to fix them. A proactive training plan demonstrates a mature management system.
Top 3 Mistakes to Avoid in Clause 7.2
- Lack of ISO 27001 Experience: Trying to run an ISMS without anyone who understands the standard is the most common reason for audit failure. Secure expert guidance or formal training immediately.
- Informal Role Assignment: Never assume the IT Manager “just knows” they are responsible. Use an Accountability Matrix to formalise responsibilities across the business.
- No Forward-Looking Training Plan: Auditors expect “Continual Improvement.” If your competence records haven’t been updated in a year and there is no plan for future training, you may receive a non-conformity.
Conclusion: Making Competence Your Core Strength
ISO 27001 Clause 7.2 is about more than ticking a compliance box; it is about embedding expertise into your security operations. By treating competence as a strategic asset, you build a resilient security culture. Follow this 10-point checklist to transform a mandatory requirement into a genuine competitive advantage for your organisation.
