Skip to Content
ISO 27001Awareness and training

Awareness and training under ISO 27001

Technical measures protect systems. People protect information. ISO 27001  recognises this and sets a mandatory measure in Annex A: control A.6.3. All employees receive suitable awareness and training on information security. The NEN version of the standard  states that this is an ongoing activity, not a one-off tick box at the start of employment. You record which competences each role needs in a competence matrix.

Security awareness is also one of the areas that the auditor actively checks during every internal audit and external audit: are employees trained, is that documented, and does the programme work?

What does ISO 27001 require on awareness?

ISO 27001 sets two overlapping requirements:

Clause 7.3 (Awareness) requires that employees are aware of:

  • The information security policy
  • Their contribution to the effectiveness of the ISMS
  • The consequences of not meeting the requirements

A.6.3 (Information security awareness, education and training) requires that employees receive suitable awareness training that matches their role and current threats. Refresh the programme regularly.

The standard does not prescribe specific forms of training. A written policy that employees sign, an e-learning module, a live session or a phishing simulation: all of them count, as long as they are demonstrable and match the risks.

What works and what does not

A one-off PowerPoint at the start of employment technically meets the requirement, but works poorly in practice. People forget most of it within a week. Effective security awareness is repeated, relevant and varied.

ApproachEffectPoint of attention
One-off trainingLowQuickly forgotten, no change in behaviour
Annual e-learningMediumGood as a supplement, not as the only measure
Phishing simulationsHighMeasures behaviour, not just knowledge
Quarterly team briefingsHighWide reach, low threshold
Current security updates after incidentsHighContext makes the information relevant
Onboarding module plus annual refresherHighBasic combination for smaller organisations

Setting up an awareness programme

You do not need to develop an extensive training curriculum. A programme that works for most small and medium-sized organisations consists of three layers:

Layer 1: Basic knowledge (at the start of employment) Every new employee completes a short introduction: what the information security policy is, how to report an incident, what to do with a suspicious email, how to use the password manager. Maximum 30 minutes. Record completion.

Layer 2: Periodic refresher (annually) An annual update: what are the current threats, which incidents have we had, what has changed in the policy? This can be a short meeting, an e-learning or a newsletter, as long as it is documented.

Layer 3: Targeted campaigns (ad hoc) After a phishing simulation, after an internal incident, or when new legislation appears (such as NIS2). Targeted communication that responds to a current trigger.

Phishing simulations

Phishing simulations send fake phishing emails to employees and measure how many people click. They work well as a learning moment, not as a punishment. After a simulation, give direct feedback: this was a test email, and here is what you could have looked out for.

Popular providers include KnowBe4 , Proofpoint Security Awareness  and Cofense . Dutch alternatives also exist. The choice depends on your budget and the level of reporting you need.

Phishing simulations are not mandatory under ISO 27001, but they provide evidence of how effective your awareness programme is. That is exactly what the auditor wants to see: not only that you trained people, but that the training works.

Use phishing simulations as learning tools, not as a way to catch or punish employees. A culture of fear is a security risk: people do not report incidents out of embarrassment.

Evidence for the audit

At every audit, the auditor asks for evidence of security awareness. Make sure you can show the following:

EvidenceHow to record it
Training recordsList with names, date and completed module
Onboarding completionSigned awareness statement or completion record in the HR system
Phishing simulation reportsExport the results from your simulation platform
Programme contentKeep the agenda, presentation or e-learning module
Feedback momentsMinutes of security briefings or email to all employees

Keep the records for at least three years, so that you also have evidence of previous years at the recertification audit.

Security awareness in practice at small organisations

A small IT company with 12 employees does not need to buy an extensive learning management system. A workable programme could look like this:

  • At onboarding: 30-minute session with the person responsible for IT. The employee signs that they have received and understood the security policy.
  • Quarter 1: Short update (10 minutes) in the monthly team meeting about the latest phishing trends.
  • Quarter 2: Phishing simulation through KnowBe4 or a similar tool.
  • Quarter 3: Repeat of the team meeting.
  • Quarter 4: Annual review of the policy, communicated to all employees.

Total: less than five hours per employee per year, but ongoing and demonstrable.

More information

Supplier managementCompetence matrix