Awareness training is not one of the eight Essential Eight strategies, but ISO 27001 does require it: Annex A.6.3 of ISO/IEC 27001:2022 makes security awareness, education and training a mandatory control of the ISMS. Here is what the control actually requires, what evidence an auditor expects, and how to run a programme that satisfies it without becoming a full-time job.
TL;DR
- ISO 27001:2022 Annex A.6.3 requires a formal, ongoing awareness, education and training programme for all personnel and relevant third parties.
- Training must be role-appropriate and reinforced over time - one induction session does not satisfy the control.
- Auditors expect dated evidence over time: completion records, content refreshes and reinforcement, not a single certificate.
- A monthly cadence with phishing simulations and per-learner reporting produces that evidence automatically.
Why this matters
ISO 27001 certification is increasingly a commercial gate: enterprise buyers and higher-assurance government work expect it, and small teams pursue it to win that work. The management-system clauses get the attention, but the Annex A controls are what an auditor tests - and A.6.3 is one of the few that touches every employee in the organisation.
The control is also the one most often evidenced thinly: a policy document and an induction slide deck. An auditor reading A.6.3 wants to see the programme operating, not described.
What ISO 27001:2022 Annex A.6.3 actually requires
Annex A.6.3 requires the organisation to establish and maintain information security awareness, education and training so that personnel understand information security risks, know their responsibilities, and act consistently in support of the ISMS.
In practice the control breaks into four requirements:
- A formal programme, not an event. Awareness must be planned, ongoing and maintained over time - induction training alone fails the control.
- Role-appropriate depth. Education matches responsibilities; a finance team handling payment fraud scenarios needs different content from a sales team protecting CRM data.
- Reinforcement of policies and expected behaviour. Training reinforces the ISMS's own policies, procedures and expectations.
- All personnel and relevant third parties. Employees at all levels, temporary and contract staff, and anyone else with access to organisational information.
The emphasis on maintaining awareness over time is the part that surprises first-time certification teams. The standard is explicit that a one-off course is not the control: awareness must be reinforced as policies, systems and threats change.
What evidence an ISO 27001 auditor expects
An auditor testing A.6.3 typically asks for:
- An awareness and training plan - what is delivered, to whom, how often.
- Dated completion records - who completed what, when, ideally per person rather than a sign-in sheet.
- Evidence of currency - content updated as policies and threats change, showing the programme is alive.
- Reinforcement between courses - phishing simulations, reminders or campaigns that keep awareness active between formal training.
- Coverage of leavers and contractors - the programme extends beyond permanent employees.
The pattern in all five: dated, per-person, continuous. A spreadsheet of names next to a certificate template fails that pattern; a per-learner record that shows what each person completed, when, and what happened when they missed a course passes it.
That is exactly what a monthly training cadence with human risk reporting produces - per-learner completion, overdue tracking and phishing results exported branded per client or per audit.
Building a programme that satisfies A.6.3
- Set a monthly cadence. Short monthly lessons beat an annual marathon: the control says maintain awareness over time, and monthly is the cheapest way to prove it.
- Baseline every new starter. Onboarding training lands in the programme automatically - the control starts at hire.
- Add role-based depth where risk is concentrated. Finance, HR and IT help desk teams face specific lures; targeted modules show the role-appropriateness the control asks for.
- Run phishing simulations as reinforcement. Simulations are the evidence of awareness operating between courses, and clickers auto-enrol into remediation - which is itself a dated record.
- Export the audit pack. Completion, overdue and phishing reporting per person, dated, exportable - the artefact that answers the auditor's question in one file.
A programme like this also earns its keep outside the audit: insurers ask for training evidence at renewal, enterprise clients ask for it in security questionnaires, and the same export answers both.
Common gaps that fail an A.6.3 audit
- Training delivered once at induction, never again. The most common failure; the control requires maintenance over time.
- No per-person records. A group sign-in sheet cannot show who actually completed what, so coverage cannot be evidenced for individuals.
- Content never refreshed. Policies changed two years ago and the training deck still describes the old process - the auditor notices.
- Contractors and third parties excluded. The control's scope is everyone with access to organisational information, not only employees.
- No reinforcement. Nothing between the annual course and the next one; phishing simulations fill exactly this gap.
Each of these is fixable with the same monthly cadence: assign, remind, record, report.
How often should the training run?
The control requires ongoing awareness, not a specified frequency - the ISMS sets the cadence in its own risk assessment. In practice monthly short training with periodic phishing simulations is the pattern certification bodies see most and accept most readily: it demonstrates continuity without demanding more learner time than an annual course.
For teams targeting ISO 27001, the pragmatic sequence is: baseline the current staff this month, fold new starters in automatically, simulate monthly, and keep the per-learner record growing. By the time the stage one audit arrives, twelve months of dated evidence exists without a scramble.
FAQ
Does ISO 27001 require security awareness training? Yes. Annex A.6.3 of ISO/IEC 27001:2022 makes security awareness, education and training a mandatory control - a formal, ongoing programme covering all personnel and relevant third parties.
How often should ISO 27001 awareness training run? The control requires ongoing awareness, not an annual event. A monthly cadence with dated per-learner records is the evidence pattern auditors accept most readily.
Does awareness training need to be role-based for ISO 27001? Yes - education should be role-appropriate. Staff handling payments, employee data or privileged access need targeted scenarios beyond the general baseline.
What evidence proves Annex A.6.3 compliance? A training plan plus dated, per-person completion records, evidence of content currency, and reinforcement between courses such as phishing simulation results.
Do contractors need to be included? Yes. The control covers relevant third parties - anyone with access to organisational information, including temporary and contract staff.