ISO 27001 A.6.3: security training, explained for startups

A.6.3 Information security awareness, education and training

Everyone learns the security basics when they join and every year. What proves it: security training that every staff member completes, and a record of who completed it.

A certification auditor samples training completion compared with headcount. A file that usually does the job: a completion export from your training platform compared with the staff list.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.6.3 walks you through it in this order.

1. Choose a training source: a platform, a recorded session or a short slide deck.
2. Have every staff member complete it at hire and each year.
3. Keep the completion record.

The free ISO 27001 readiness assessment asks one question that evidences it:

• Do staff complete security awareness training when they join and every year, with records kept?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the People and Human Resources Security Policy covers A.6.3. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC1.4, hiring and competence and CC2.2, internal communication.

People controls

A.6.3 is one of the 8 people controls in Annex A. What happens before, during and after someone works for you: screening, terms, training, discipline, remote work and reporting. Small teams meet these with a handful of signed records.

Nearby controls in the same theme:

• A.6.1, background screening
• A.6.2, employment terms
• A.6.4, disciplinary process
• A.6.5, duties after leaving
• A.6.6, confidentiality agreements

Before it: A.6.2, employment terms. After it: A.6.4, disciplinary process. Every control, by theme, is on the Annex A controls page.