ISO 27001 Clause 7.3 Awareness

Home / ISO 27001 Clauses / ISO 27001 Clause 7.3 Awareness

Information security awareness is about making people aware of the risks to information security so they can be better prepared and better protected.

In this ultimate guide to ISO 27001:2022 Clause 7.3 Awareness you will learn

  • What ISO 27001 Clause 7.3 is
  • How to implement it
  • Approaches to information security awareness with examples

What is ISO 27001 Clause 7.3?

ISO 27001 Clause 7.3 is Awareness and it requires you to communicate and make people aware of the information security policy, how they contribute to information security and the consequences of not conforming to information security.

The ISO 27001 standard for ISO 27001 certification wants you to let people know what you expect, educate them and have processes in place for if things go wrong.

Purpose

The purpose of ISO 27001 clause 7.3 is to make sure people are aware of information security and what they need to do. It is part of implementing a culture of information security into the organisation.

Definition

The ISO 27001 Standard defines ISO 27001:2022 Clause 7.3 as:

Persons doing work under the organisation’s control shall be aware of:
a) the information security policy;
b) their contribution to the effectiveness of the information security management system, including the benefits of improved information security performance; and
c) the implications of not conforming with the information security management system requirements.

ISO 27001:2022 Clause 7.3 Awareness

Requirement

The requirement is to tell people what is expected of them and explain to them the consequences of not doing what is expected when it comes to information security.

Implementation Guide

There are distinct phases in the journey of staff, contractors and third parties.

Each of those phases potentially requires a different level of communication.

It is possible that one approach will work but the likelihood is you are going to have different communication styles and approaches depending on the ‘who’ and the ‘where’ they are in their journey with you.

Onboarding

Include copies of policies and the employee handbook as part of onboarding.

Arrange a dedicated face to face session to explain the information security approach of the business, where the policies are, who is responsible for information security, how to raise a security incident.

Cover how their role contributes to information security and what is required of them.

Enrol them on the general information security awareness training and basic GDRP / Data Protection training if you use a training tool or do it face to face and get them to sign that they attended and understood.

Throughout the Year

Plan you training and awareness throughout the year based on risk and business need.

As well as the information security and data protection training perhaps people need educating on the risks of home working. Or perhaps on the perils of phishing attacks.

The process of awareness should be on going.

Annually

Conduct the general information security awareness training and the general data protection training at least annually.

Even it is just a refresher people should formally go through basic training once a year.

On Ending Employment / Engagement

Ensure that at the end of employment or the end of engagement that you communicate the contractual obligations that are, and will remain, in play in regards to information security.

ISO 27001 Continual Improvement

Continually update your training and your awareness program to respond to known threats, risks and issues.

Get an information security training tool

In this day and age one of the few times we would recommend the use of a tool is for information security training. These come with courses pre built in and allow for the automation of many of the required tasks around awareness. Scheduling the awareness and verifying understanding is a must have as well as the ability to report. These tools will refresh content annually which saves you time and effort and will include popular modules for topics that are likely to be relevant to you. Being online they can be taken by staff from anywhere.

Implement an ISO 27001 Communication Plan

Having a communication plan that records what you communicated, when, to whom and the evidence that you did is also part of showing compliance to the clause.

Implement an information security training and awareness policy.

The information security training and awareness policy clearly sets out what you do for information security training and awareness and can be shared with staff, auditors and clients.

ISO 27001 Templates

ISO 27001 templates are a great way to implement your information security management system.

DO IT YOURSELF ISO 27001

All the templates, tools, support and knowledge you need to do it yourself.

ISO 27001 Clause 7.3 Training Video

Watch the ISO 27001 Clause 7.3 YouTube tutorial How to Implement ISO 27001 Clause 7.3 Awareness

ISO 27001 Awareness and Training

In this day and age one of the few times we would recommend the use of a tool is for information security training.

These come with courses pre built in and allow for the automation of many of the required tasks around awareness.

Scheduling the awareness and verifying understanding is a must have as well as the ability to report.

These tools will refresh content annually which saves you time and effort and will include popular modules for topics that are likely to be relevant to you.

Being online they can be taken by staff from anywhere.

These are not the only ways to raise and manage awareness but they do the lions share of the work.

Of course you will want to consider your company culture and supplement this. Emails are great but also standup meetings, have presentations at company meetings, perhaps bringing outside resource. There is no one size fits all answer but training tools go a long way for those that are time poor and just want to get the job done and move on.

How to pass an audit

The easiest way is to have a training tool that records people’s understanding by presenting with training and what you want them to be aware of and then has them take a test which you can report.

Having a communication plan that records what you communicated, when, to whom and the evidence that you did is also part of showing compliance to the clause.

There is a place for the signing of policies to accept them and the way you do this can be via traditional signature (which is clunky but doable), electronic signature, or an email to you that they have read and accept them. There are many ways to skin a cat.

What the auditor will check

The audit is going to check a number of areas for compliance with Clause 7.3. Lets go through them

1. That you have a communication plan

The auditor wants to see a plan for communication that includes awareness and evidence that communications relating to awareness have taken place.

2. That consequences of not doing what is expected

The auditor wants to that you have communicated what will happen if people do not do what is expected of them for information security. In addition they will want to see the process that you would follow even if you have not had to follow it in the last 12 months.

It is usual to include this as part of the information security policies.

FAQ

What is ISO 27001 Clause 7.3 Awareness?

The ISO 27001 standard requires an organisation to have people that are competent to do the work for information security. Simple.

What are the ISO 27001:2022 Changes to Clause 7.3?

Great news. There are no changes to ISO 27001 Clause 7.3 in the 2022 update.

How do I evidence I meet the requirement of ISO 27001 Clause 7.3?

The best way is to record training in a training tool that requires a test to show understanding. Having a communication plan that includes evidence of the communications is also required.

Who is responsible for ISO 27001 Clause 7.3?

Senior management are responsible for ensuring that ISO 27001 Clause 7.3 is implemented and maintained.

Why is ISO 27001 Clause 7.3 important?

People cannot be expected to act and do in a certain way unless they have been told what is expected of them. Equally, they need to know what the consequences can be if they do not do what is expected. In addition on going awareness is about building and establishing a culture of information security into the organisation. By implementing awareness you will ensure that you have an effective information security management system (ISMS).

Where can I download ISO 27001 Clause 7.3 templates?

You can download ISO 27001 Clause 7.3 templates in the ISO 27001 Toolkit.

ISO 27001 Clause 7.3 example?

An example of ISO 27001 Clause 7.3 can be found in the ISO 27001 Toolkit.