Table of contents
ISO 27001 Awareness
In this ultimate guide to ISO 27001 Clause 7.3 Awareness you will learn
- What is ISO 27001 Clause 7.3
- How to implement ISO 27001 Clause 7.3
I am Stuart Barker, the ISO 27001 Ninja and author of the Ultimate ISO 27001 Toolkit.
With over 30 years industry experience I will show you what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it for ISO 27001 certification.
Watch the Tutorial
Watch How to Implement ISO 27001 Clause 7.3 Awareness
What is ISO 27001 Clause 7.3?
ISO 27001 Clause 7.3 is an ISO 27001 control that requires you to communicate and make people aware of the information security policy, how they contribute to information security and the consequences of not conforming to information security.
The ISO 27001 standard for ISO 27001 certification wants you to let people know what you expect, educate them and have processes in place for if things go wrong.
DO IT YOURSELF
ISO 27001
ISO 27001 Clause 7.3 Purpose
The purpose of ISO 27001 clause 7.3 is to make sure people are aware of information security and what they need to do. It is part of implementing a culture of information security into the organisation.
ISO 27001 Clause 7.3 Definition
The ISO 27001 Standard defines clause 7.3 as:
Persons doing work under the organisation’s control shall be aware of:
ISO27001:2022 Clause 7.3 Awareness
a) the information security policy;
b) their contribution to the effectiveness of the information security management system, including the benefits of improved information security performance; and
c) the implications of not conforming with the information security management system requirements.
ISO 27001 Clause 7.3 Requirement
The requirement is to tell people what is expected of them and explain to them the consequences of not doing what is expected when it comes to information security.
What are the ISO 27001:2022 Changes to Clause 7.3?
Great news. There are no changes to ISO 27001 Clause 7.3 in the 2022 update.
ISO 27001 Clause 7.3 Implementation Guide
There are distinct phases in the journey of staff, contractors and third parties.
Each of those phases potentially requires a different level of communication.
It is possible that one approach will work but the likelihood is you are going to have different communication styles and approaches depending on the ‘who’ and the ‘where’ they are in their journey with you.
Onboarding:
Include copies of policies and the employee handbook as part of onboarding.
Arrange a dedicated face to face session to explain the information security approach of the business, where the policies are, who is responsible for information security, how to raise a security incident.
Cover how their role contributes to information security and what is required of them.
Enrol them on the general information security awareness training and basic GDRP / Data Protection training if you use a training tool or do it face to face and get them to sign that they attended and understood.
Throughout the Year:
Plan you training and awareness throughout the year based on risk and business need.
As well as the information security and data protection training perhaps people need educating on the risks of home working. Or perhaps on the perils of phishing attacks.
The process of awareness should be on going.
Annually:
Conduct the general information security awareness training and the general data protection training at least annually.
Even it is just a refresher people should formally go through basic training once a year.
On Ending Employment / Engagement:
Ensure that at the end of employment or the end of engagement that you communicate the contractual obligations that are, and will remain, in play in regards to information security.
ISO 27001 Continual Improvement:
Continually update your training and your awareness program to respond to known threats, risks and issues.
Stop Spanking £10,000s on consultants and ISMS Online tools.
ISO 27001 Awareness and Training
In this day and age one of the few times we would recommend the use of a tool is for information security training.
These come with courses pre built in and allow for the automation of many of the required tasks around awareness.
Scheduling the awareness and verifying understanding is a must have as well as the ability to report.
These tools will refresh content annually which saves you time and effort and will include popular modules for topics that are likely to be relevant to you.
Being online they can be taken by staff from anywhere.
These are not the only ways to raise and manage awareness but they do the lions share of the work.
Of course you will want to consider your company culture and supplement this. Emails are great but also standup meetings, have presentations at company meetings, perhaps bringing outside resource. There is no one size fits all answer but training tools go a long way for those that are time poor and just want to get the job done and move on.
How to pass an audit of ISO 27001:2022 Clause 7.3
The easiest way is to have a training tool that records people’s understanding by presenting with training and what you want them to be aware of and then has them take a test which you can report.
Having a communication plan that records what you communicated, when, to whom and the evidence that you did is also part of showing compliance to the clause.
Time needed: 1 day
How to pass an audit of ISO 27001:2022 Clause 7.3
- Get an information security training tool
In this day and age one of the few times we would recommend the use of a tool is for information security training. These come with courses pre built in and allow for the automation of many of the required tasks around awareness. Scheduling the awareness and verifying understanding is a must have as well as the ability to report. These tools will refresh content annually which saves you time and effort and will include popular modules for topics that are likely to be relevant to you. Being online they can be taken by staff from anywhere.
- Implement an ISO 27001 Communication Plan
Having a communication plan that records what you communicated, when, to whom and the evidence that you did is also part of showing compliance to the clause.
- Implement an information security training and awareness policy.
The information security training and awareness policy clearly sets out what you do for information security training and awareness and can be shared with staff, auditors and clients.
There is a place for the signing of policies to accept them and the way you do this can be via traditional signature (which is clunky but doable), electronic signature, or an email to you that they have read and accept them. There are many ways to skin a cat.
What the auditor will check
The audit is going to check a number of areas for compliance with Clause 7.3. Lets go through them
1. That you have a communication plan
The auditor wants to see a plan for communication that includes awareness and evidence that communications relating to awareness have taken place.
2. That consequences of not doing what is expected
The auditor wants to that you have communicated what will happen if people do not do what is expected of them for information security. In addition they will want to see the process that you would follow even if you have not had to follow it in the last 12 months.
It is usual to include this as part of the information security policies.
ISO 27001 Templates
ISO 27001 templates are a great way to implement your information security management system. Whilst an ISO 27001 Toolkit can save you up to 30x in consulting fees and allow you to deliver up to 10x faster these individual templates help meet the specific requirements of ISO 27001 clause 7.3
ISO 27001 Clause 7.3 FAQ
The ISO 27001 standard requires an organisation to have people that are competent to do the work for information security. Simple.
The best way is to record training in a training tool that requires a test to show understanding. Having a communication plan that includes evidence of the communications is also required.
Senior management are responsible for ensuring that ISO 27001 Clause 7.3 is implemented and maintained.
People cannot be expected to act and do in a certain way unless they have been told what is expected of them. Equally, they need to know what the consequences can be if they do not do what is expected. In addition on going awareness is about building and establishing a culture of information security into the organisation. By implementing awareness you will ensure that you have an effective information security management system (ISMS).
You can download ISO 27001 Clause 7.3 templates in the ISO 27001 Toolkit.
An example of ISO 27001 Clause 7.3 can be found in the ISO 27001 Toolkit.