Competence matrix ISO 27001 (clause 7.2) with example
A competence matrix is an overview of which role needs which knowledge, training and experience, and who has them. ISO 27001 requires this in clause 7.2: determine the necessary competence, make sure that people have it, take action if they do not, and keep evidence. The standard does not prescribe a format. The evidence belongs with the mandatory documents. In practice, a matrix in Excel or a table in your wiki is the most common approach, and auditors know that pattern well. For employee awareness, read awareness and training.
What does clause 7.2 require?
Clause 7.2 consists of four steps that you must be able to demonstrate:
- Determine. Which competence is needed for work that affects information security?
- Ensure. Does the person have that competence, based on education, training or experience?
- Act. If not, you take measures (train, coach, hire) and evaluate the result.
- Evidence. Keep documented information as evidence, such as diplomas, certificates and training records.
It is not only about permanent employees. Hired and outsourced work is also covered, if that work affects the ISMS. Think of an external administrator with access to the servers or a cleaning company with office keys. See also the requirements of the standard for the context of clause 7.
A competence matrix is the evidence, not the competence itself. A matrix where everything says “yes” without justification is easy to check in an audit and quickly raises suspicion.
Structure of a competence matrix
A usable matrix has one row per role and one column per competence. Use this as a basis:
| Column | What you fill in | Example |
|---|---|---|
| Role | The job or role, not the name | System administrator |
| Responsibility for ISMS | What this role affects | Managing servers and backups |
| Required competence | Concrete: knowledge, certificate, experience | Knowledge of hardening, backup procedure |
| Education or certificate | What the person has | Linux certificate, internal backup training |
| Experience | In years or projects | 6 years of Linux administration |
| Status | Compliant, in training, or action needed | Compliant |
| Evaluation and date | When assessed and by whom | May 2026, team leader |
| Evidence | Where the document is kept | HR folder, certificate in personnel file |
Many teams keep it smaller. Two columns (required and present) with a link to the evidence are also enough, as long as the logic holds.
Example: a matrix for a small IT company
This is a fictional example of “Example BV”, a company with twelve employees.
| Role | Required competence | Present | Status | Action |
|---|---|---|---|---|
| Management | Knowledge of ISMS responsibility and risks | Course for board members on information security (2025) | Compliant | Refresh annually |
| Security officer | Knowledge of ISO 27001 and internal audit | Lead Implementer, internal auditor | Compliant | None |
| System administrator | Hardening, backups, log management | 6 years of experience, Linux certificate | Compliant | None |
| Helpdesk employee | Recognising phishing and social engineering | Awareness training (2026) | In training | Complete training before 1 December |
| Developer | Secure programming (OWASP) | No formal training yet | Action needed | Plan training in Q1 2027 |
| External administrator | Required security controls from the contract | Declaration from the supplier | Compliant | Request declaration annually |
Note the last row. An external party must also be demonstrably competent. This belongs to supplier management.
How do you set up the matrix in four steps?
List the roles that affect the ISMS
Do not start with people but with roles. Ask: who has access to systems, data or processes that we have in scope?
Determine what is needed per role
Write down concretely what someone must be able to do. “Good with IT” is not a competence. “Can restore a backup and verify the result” is.
Check the current situation
For each person, establish what is demonstrably in place. Use diplomas, certificates, training records and performance reviews.
Record the actions
For every gap: what will you do, who owns it, when is it done, and how do you know it works?
Repeat this at least once a year, and with every new role or major change. The internal audit is a good moment to check whether the matrix is up to date.
What does the auditor ask?
The auditor selects a few roles and asks for the evidence. He wants to see that the matrix matches reality: an administrator listed in the matrix with a certificate must also be able to show that certificate. He also checks whether the requirements in the matrix really relate to the work. A matrix that lists only “Microsoft Office” as a competence for a security role stands out immediately. See the audit questions and checklist for the questions per role.
Common mistakes
- Everything marked “compliant”. Without evidence, every “compliant” is just a claim.
- Vague competences. “Experience with IT” says nothing about what someone can do.
- The matrix is never updated. A matrix that is two years old, with people who have left, is worse than no matrix.
- Externals are forgotten. Temporary staff and suppliers with access are also covered.
- No link to evidence. The auditor must be able to find the certificate, not just the line in the table.
Link with awareness
Many organisations see the competence matrix and the awareness programmes as two separate things. They are not. The awareness programme is a means of reaching competence, and the matrix shows whether it works. An employee who has completed the training and passed a test is evidence for both A.6.3 and clause 7.2.
Frequently asked questions
Does every employee need to be in the matrix? No. Only roles that affect the ISMS. A cleaner without system access does not need to be included, unless the contract sets security requirements.
Which format is best? The one you keep up to date. Excel, a table in SharePoint or an HR system all work, as long as the version and the evidence are correct.
Is a certificate always needed? No. A certificate is one form of evidence. Demonstrated experience, an internal test or a recorded conversation with a documented result can also serve.