ISO 27001 and security awareness training: What Annex A actually requires

ISO 27001 is one of the most recognized information security standards in the world, and for many organizations, certification is a way to prove to customers that they take security seriously. But there is a persistent misunderstanding about what the standard actually requires when it comes to training. ISO 27001 does not have a single line item that says, in so many words, train your employees annually. Instead, the obligation is woven through the standard's Annex A controls, and auditors evaluate it through a lens of evidence and competence. Here is what the standard really asks.

What ISO 27001 is

ISO 27001 is a management system standard. It does not prescribe a specific set of technical controls, but instead requires organizations to establish, implement, and maintain an information security management system, or ISMS, built around risk assessment and continuous improvement. Annex A provides a catalog of controls that organizations select based on their risk assessment. This structure is the key to understanding the training requirement: it is not a fixed mandate but an obligation that arises from the standard's demand for competence and awareness.

The relevant Annex A controls

Two Annex A controls matter most for training. Control A.7.2.2, information security awareness, education, and training, requires that all employees receive appropriate awareness education and regular updates on the organization's policies and procedures. Control A.6.1.1, on roles and responsibilities, requires that responsibilities be communicated, which implies people understand them. Together, these controls establish that training is not optional, it is a necessary part of demonstrating that the ISMS actually functions.

Competence versus awareness

ISO 27001 draws a useful distinction between competence and awareness. Competence, covered under the human resources controls, refers to people having the skills to do their jobs securely, whether that means a developer writing secure code or an administrator configuring systems. Awareness refers to the broader workforce understanding the risks and their role in managing them. Both matter, but the awareness obligation is the one that applies to everyone, from the receptionist to the board, and it is the one that most closely maps to a security awareness program.

What auditors actually evaluate

ISO 27001 certification is conducted by accredited certification bodies, and auditors are trained to look for evidence. When they assess the training controls, they typically ask to see: records showing that training was delivered and who completed it; the content or curriculum, to confirm it covers awareness of policies and procedures; and evidence that training is updated and repeated over time. A claim that training happens, without documentation, does not satisfy an auditor. The standard is evidence-based, and training is no exception.

How ISO 27001 overlaps with SOC 2

Organizations pursuing both ISO 27001 and SOC 2 often find significant overlap in the training requirements. SOC 2's Trust Services Criteria, specifically the communication and competence criteria, demand much the same thing: that security responsibilities are communicated and that personnel are competent. A single, well-documented security awareness program can satisfy both frameworks simultaneously, which is why many organizations align their certification efforts rather than treating each as a separate project. The overlap is a reminder that, beneath different labels, the underlying expectation is consistent.

Making training work for certification

The practical approach to ISO 27001 training is to treat it as a documented, recurring program rather than a one-time event. That means: delivering awareness training to all employees, covering the policies and procedures that matter to them; keeping records of who completed training and when; updating content as policies and risks change; and reviewing the program as part of the ISMS's continuous improvement cycle. Organizations that do this find the training controls among the easiest to satisfy, because the requirement is clear and the evidence is straightforward to produce. Those that skip documentation find it among the most common sources of nonconformity.