Key takeaways
- Train staff so they understand security and their responsibilities.
- People are your first line of defence.
- Start here: run security awareness training at onboarding and at least yearly.
Purpose
Train staff so they understand security and their responsibilities.
Requirement
Requirement summaryPersonnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization's information security policy, topic-specific policies and procedures, as relevant for their job function.
Why it matters
People are your first line of defence. Training turns policy into everyday behaviour.
How to implement
- Run security awareness training at onboarding and at least yearly.
- Add role-specific training for developers, admins and managers.
- Use phishing simulations and short refreshers.
- Track completion and follow up on gaps.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 6.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your training plan: what security training each role needs and how often.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.6.3 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Training completion records for all staff, including new starters.
- Copies of the training content, showing it is up to date.
- Records of extra training for technical roles (developers, administrators, incident team).
- Results of phishing tests or short quizzes, if you use them.
Things you should be able to show or explain
- Staff should be able to explain how to report a security problem.
How much to show: 10 or so staff, including recent starters and administrators.
Common mistakes
- Overdue training not chased.
- Training content years out of date.
- One long annual video that nobody remembers.
- No record of who completed training.
- Tip: Short, regular training beats one long annual session.
Policies & documents to have
- Human Resource Security Policy
FAQ
Is A.6.3 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.6.3?
Be ready to explain how the control works in your organisation and to provide things like: Your training plan: what security training each role needs and how often…