The ISO 27001 Information Security Training Awareness Policy is the cornerstone of implementing and culture of information security into an organisation. It is also a requirement of the ISO 27001 standard.
Table of contents
- What is it?
- Applicability to Small Businesses, Tech Startups, and AI Companies
- ISO 27001 Security Training and Awareness Policy Template
- Why You Need It
- When You Need It
- Who Needs It?
- Where You Need It
- How to Write It
- How to Implement It
- Examples of using it for small businesses
- Examples of using it for tech startups
- Examples of using it for AI companies
- How the ISO 27001 Toolkit Can Help
- Information Security Standards that Need It
- List of Relevant ISO 27001:2022 Controls
- ISO 27001 Security Training and Awareness Policy Example
- ISO 27001 Security Training and Awareness Policy FAQ
What is it?
Think of your ISO 27001 Training and Awareness Policy as a simple guide that explains how you’ll teach everyone in your company about information security. It’s like a rulebook that makes sure everyone knows how to protect your company’s important data. The goal is to make sure everyone, from the CEO to the newest intern, understands their role in keeping information safe. It’s about building a strong security culture so everyone thinks about security in their daily work.
Applicability to Small Businesses, Tech Startups, and AI Companies
This policy is useful for businesses of all sizes, including small businesses, tech startups, and AI companies.
- Small Businesses: You may think this is too big for you, but it’s not! It helps you show clients you take their data seriously. It builds trust and can give you a leg up on competitors. It’s a great way to start building a good security habit early on.
- Tech Startups: Since you’re building new things, security often gets pushed to the side. This policy helps you bake security into your products from the beginning, which is way easier than trying to fix it later. It also gives your early customers confidence that their data is safe with you.
- AI Companies: You’re dealing with huge amounts of data, much of it sensitive. This policy is a must-have for you. It helps you protect your valuable AI models and the data you use to train them. It’s all about making sure your AI systems are trustworthy and secure.
ISO 27001 Security Training and Awareness Policy Template
The ISO 27001:2022 Security Training and Awareness Policy Template is designed to fast track your implementation and give you an exclusive, industry best practice policy template that is pre written and ready to go. It is included in the ISO 27001 toolkit.
Why You Need It
You need this policy because it’s a key part of getting and keeping your ISO 27001 certification. More than that, it helps protect your business from cyberattacks, data breaches, and other security risks. When everyone knows what to do, you’re much less likely to have a security incident. Plus, it shows your customers, partners, and regulators that you’re serious about protecting their data. It’s a great way to build trust and a good reputation.
When You Need It
You should write this policy as one of the first things you do when you start working on your ISO 27001 certification. You’ll also need to review it at least once a year to make sure it’s still current and effective.
Who Needs It?
Everyone in your organization needs to be part of this. Whether they’re full-time employees, part-time staff, contractors, or even volunteers, if they touch your company’s information, they need to know what’s in this policy.
Where You Need It
This policy lives inside your Information Security Management System (ISMS). You should also make sure it’s easy for everyone to find. You can put it on your company’s intranet or in a shared folder, for example. The key is to make it easy to access and read.
How to Write It
Start by outlining the basics. Talk about who the policy applies to and what its purpose is. Then, list the different training topics you’ll cover, like phishing, password security, and data handling. Describe how often people need to take training and how you’ll keep track of it. Keep the language simple and direct. Avoid jargon. Remember, you want people to actually read and understand it.
Time needed: 1 hour and 30 minutes
How to write an ISO 27001 information security awareness and training policy
- Create your version control and document mark-up
ISO 27001 documents require version control of the author, the change, the date and the version as well as document mark up such as document classification.
- Write the policy purpose
The purpose of the Information Security Awareness Training policy is to protect against loss of data.
- Write the scope of the policy
It should really apply to all employees and third party staff working for your company. An example:
All employees and third-party users. - Write the principle on which the policy is based
The principle of the Information Security Awareness Training policy is the confidentiality, integrity and availability of data. Accordingly it is about the security and protection of confidential data. An example:
Management is committed to information security throughout the organisation and awareness, training, and education. - Write Information Security Awareness and Training Topics
Write a statement that lists out the topics that your plan will cover. Particularly phishing, general security awareness, data protection are all good base topics to include. An example:
The topics covered:
– stating management’s commitment to information security throughout the organization
– the need to become familiar with and comply with applicable information security rules and obligations, as defined in policies, standards, laws, regulations, contracts, and agreements
– personal accountability for one’s own actions and inactions, and general responsibilities towards securing or protecting information belonging to the organization and external parties.
– basic information security procedures (such as information security incident reporting) and baseline controls (such as password security, malware controls and clear desks)
– contact points and resources for additional information and advice on information security matters, including further information security education and training materials. - Describe what happens for new starters
New starters to the organisation will need training so set out on what and when. An example:
Information Security training is provided to new starters before they are provided access to systems that process, store of transmit confidential, personal or cardholder data.
The Information Security Policy is provided to new starters as part of the on-boarding process. - Describe what happens for in role employees
Training is not a one and done so the Information Security Awareness Training policy will cover continual training and annual reacknowledgment. An example:
General Information Security training is conducted for employees at least annually.
Information Security awareness is provided throughout the year utilising a wide range of media and techniques.
Information Security training is provided when roles significantly change or access to data types changes and based on risk and the needs of the role. - Implement a training and competency register
The standard and best practice require us to understand the competency of staff in relation to information security and any training requirements. Therefore implement a Competency Matrix. An example:
A register of information security training and competency is maintained for employees. - Create a training plan
To be effective it is best to plan training throughout the year and follow the plan. An example:
A communication plan includes training and awareness campaigns for the year.
The training and awareness plan is based on legal and regulatory requirements, business need and risk. - Include training assessment and acceptance
It is not enough to send out training, we also need to ensure people have understood it and accepted it. An example:
Employees are assessed on their understanding of information security and formally sign that they have received training. - Define policy compliance
Provide for how compliance to the policy will be achieved.
How to Implement It
First, make a plan for your training. Decide what topics you’ll cover and how you’ll deliver the training. Will it be a video, an online course, or an in-person workshop? Then, set up a way to track who has completed the training. You can use a spreadsheet or a learning management system (LMS). Finally, make sure to send out reminders and announcements so everyone knows when and how to complete their training.
Examples of using it for small businesses
A small marketing firm with 10 employees might have a simple policy. It could require a short, 15-minute online video on how to spot a phishing email. They’d also have a quick annual meeting to review key security rules, like not sharing passwords.
Examples of using it for tech startups
A startup that makes a new app would have a policy that focuses on secure coding practices. Their training would include topics on how to write code that’s free of common security bugs. They’d also have a special session for new hires to teach them how to use the company’s security tools.
Examples of using it for AI companies
An AI company that uses lots of sensitive data would have a policy with a strong focus on data privacy. Their training would cover rules on how to handle and anonymize data. It would also teach employees how to secure the AI models themselves and protect against attacks that try to trick the AI.
How the ISO 27001 Toolkit Can Help
An ISO 27001 toolkit is a collection of pre-made documents, like templates and checklists, that help you put together your ISMS. It can save you a ton of time and effort. It gives you a great starting point for your policy and other important documents.
Information Security Standards that Need It
This policy is a key part of ISO 27001, which is an international standard for managing information security. Other standards that need it include:
- GDPR (General Data Protection Regulation)
- CCPA (California Consumer Privacy Act)
- DORA (Digital Operational Resilience Act)
- NIS2 (Network and Information Security (NIS) Directive)
- SOC 2 (Service Organisation Control 2)
- NIST (National Institute of Standards and Technology)
- HIPAA (Health Insurance Portability and Accountability Act)
List of Relevant ISO 27001:2022 Controls
A control is just a way to manage a risk. Here are some of the key controls that relate to your training and awareness policy:
- The updated control for Information Security training is now ISO 27001:2022 Annex A 6.3 Information Security Awareness, Education and Training.
- In the Essential Guide to ISO 27001:2022 7.2 Competence we took a deep dive into the requirements for training as part of demonstrating competence.
- In the Essential Guide to ISO 27001:2022 7.3 Awareness we took a deep dive into what the actual requirement of the ISO 27001 standard is and how to comply with it.
ISO 27001 Security Training and Awareness Policy Example
Below is an example ISO 27001 Information Security Training Awareness Policy
ISO 27001 Security Training and Awareness Policy FAQ
Awareness is about telling people what to be careful about. Training is about teaching them how to actually do it.
At least once a year, but it’s a good idea to do small, regular reminders too.
Usually, it’s the Information Security Officer or a similar role.
Yes! They should get a security briefing as part of their onboarding.
Absolutely! Online courses are a great way to deliver training.
You should give them another chance and offer more help if they need it.
Yes, anyone with access to your information should be trained.
Keep records of who completed the training and when.
Make the training fun and relevant to their jobs.
No, one main policy is usually enough, but you can add specific details for different teams.
Yes, it should be a required part of everyone’s job.
You should send out a quick reminder or a short notice to everyone.
No, it’s for any company that wants to protect its data.
You can track how many security incidents happen or do a quick quiz after the training.
To be careful and to report anything that looks suspicious!
