Key takeaways
- Determine the skills needed, make sure people have them (training, hiring), and keep evidence.
- People doing security work must have the right skills.
- Start here: define competence needed for ISMS roles.
Purpose
Determine the skills needed, make sure people have them (training, hiring), and keep evidence.
Requirement
Requirement summarya) determine the necessary competence of person(s) doing work under its control that affects its information security performance; b) ensure that these persons are competent on the basis of appropriate education, training, or experience; c) where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken; and d) retain appropriate documented information as evidence of competence. NOTE Applicable actions can include, for example: the provision of training to, the mentoring of, or the re- assignment of current employees; or the hiring or contracting of competent persons.
Why it matters
People doing security work must have the right skills.
How to implement
- Define competence needed for ISMS roles.
- Assess current competence and fill gaps through training or hiring.
- Evaluate the effectiveness of actions taken.
- Keep records of competence.
What evidence you need to provide
Here is what you will typically need to provide for Clause 7.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- A list of the skills and knowledge needed for security roles.
Records and examples to show
- Training records, certificates or CVs showing people have the needed skills.
- Records of training planned to fill gaps, and checks that it worked.
Things you should be able to show or explain
- People in key roles should be able to explain how they keep their skills current.
How much to show: All people in key security roles.
Common mistakes
- No skills defined.
- Gaps found but not addressed.
- Training given but no records kept.
- No competence requirements defined.
- Tip: Auditors love version history. Control your documents from day one.
Policies & documents to have
- Human Resource Security Policy
- Information Security Policy
FAQ
Can we exclude clause 7.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Competence requirements defined and records kept.