Key takeaways
- Everyone should know the policy, how they contribute, and the consequences of not following it.
- Everyone must understand the policy and their role in keeping information safe.
- Start here: explain the policy, how staff contribute and consequences of non-compliance.
Purpose
Everyone should know the policy, how they contribute, and the consequences of not following it.
Requirement
Requirement summarya) the information security policy; b) their contribution to the effectiveness of the information security management system, including the benefits of improved information security performance; and c) the implications of not conforming with the information security management system requirements.
Why it matters
Everyone must understand the policy and their role in keeping information safe.
How to implement
- Explain the policy, how staff contribute and consequences of non-compliance.
- Deliver awareness at onboarding and periodically.
- Check understanding with quizzes or interviews.
- Refresh after major changes.
What evidence you need to provide
Here is what you will typically need to provide for Clause 7.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your awareness programme plan: topics, audience and timing.
Records and examples to show
- Completion records for awareness training.
- Awareness messages, posters or newsletters.
Things you should be able to show or explain
- Staff should know the policy exists, how they contribute and what happens if rules are broken.
How much to show: Ask five or so staff.
Common mistakes
- Staff unaware of the policy.
- Awareness only once at onboarding.
- Awareness limited to an annual click-through.
- Staff unaware of the policy when asked.
- Tip: Auditors love version history. Control your documents from day one.
Policies & documents to have
- Human Resource Security Policy
- Information Security Policy
- Information security communication plan
- ISMS roles, responsibilities and authorities document
FAQ
Can we exclude clause 7.3?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Staff can explain the policy basics when asked.