In this ultimate how to implement guide to ISO 27001 Clause 7.2 Competence, you will learn directly from an ISO 27001 Lead Auditor:
The 10-Point Implementation Checklist for Clause 7.2
A structured process is critical for compliance and building a robust security culture. Use this roadmap to ensure nothing is missed when establishing competence for your ISMS.
- Engage Trained ISO 27001 Resources: Secure access to expertise early. Options include hiring an external consultant, recruiting a full-time specialist, or investing in internal staff training through recognised bodies.
- Phase Your Resource Usage: Use specialist resources for the initial “Establishment” and “Certification” phases. Transition to internal staff for “Maintenance” and “Continual Improvement,” using specialists only for periodic audits or sense-checking.
- Assign ISO 27001 Roles and Responsibilities: Formally document ISMS roles. Refer to Clause 7.1 (Resources) to understand which roles are needed before assigning individuals.
- Complete the Accountability Matrix: Create a document (often a RACI matrix) that records who is responsible for each ISO 27001 clause and each Annex A control. This is a primary document auditors expect to see.
- Identify Required Security Skills: Determine the specific skills your context requires. While CISSP or CISM are great, prioritize ISO 27001 Lead Auditor or Lead Implementer qualifications for the standard itself, alongside technical skills like AWS security or network forensics.
- Produce a Competency Matrix: This is your primary evidence. It maps personnel to their relevant skills, qualifications, and experience. It highlights both your strengths and your “competency gaps.”
- Manage Ongoing Competence: Competence is not a one-time event. Track status using categories such as “Trained,” “Experienced,” “Qualified,” or “Training Planned.”
- Retain Evidence of Competence: Maintain a “belts and braces” evidence folder. Collaborate with HR to keep copies of certificates, training logs, attendance records, and professional references.
- Address Legal and Regulatory Competence: For areas like GDPR or niche legal counsel, you can outsource competence. A signed contract with a specialist law firm is acceptable evidence of competence for these functions.
- Implement Targeted Training: Close gaps with formal training. Be aware that while “Lead Auditor” courses satisfy auditors, they focus on the standard’s semantics; supplement these with internal workshops on your specific policies and tools.
About the author
