Information Security Competence, Awareness and Training Procedure¶

Purpose. Ensures people doing work under Soon's control are competent and aware of their information security responsibilities (ISO/IEC 27001:2022 7.2, 7.3 and control A.6.3). Mandatory; addresses risk R-19 (phishing/social engineering) and R-06 (AI tooling use).

1. Competence (7.2)¶

The ISM identifies the competences needed for ISMS roles (ISM, technical security lead, risk/asset owners, developers).
Competence is met through experience, training or external support (e.g. the consultant). Gaps are addressed by training or hiring/contracting.
Records of relevant qualifications/training are retained as evidence. Training and awareness completions are recorded in the Training & Awareness Log, which is version controlled in this repository so each entry carries an author and a date in git history. Qualifications and CVs, where held, are in Google Drive → HR.

2. Awareness (7.3 / A.6.3)¶

All personnel and contractors are made aware of: - The information security policy and their responsibilities under it. - How to recognise and report security events (phishing, lost devices, suspicious activity) via the Event Reporting Procedure. - Key day-to-day rules: acceptable use, BYOD/endpoint security, MFA/SSO, secure handling of customer data, and acceptable use of AI tools (no secrets/customer PII in consumer AI tools). - The consequences of not conforming.

3. Training programme¶

Audience	Topic	When
All staff & contractors	Security awareness induction	On joining (part of onboarding / New Starter Checklist)
All staff & contractors	Refresher awareness (incl. phishing)	At least annually
Engineers	Secure development / secure coding (OWASP), as a module of the refresher	On joining + annually, in the same sitting as the refresher
All staff	Targeted updates after major changes/incidents	As needed

Awareness material is ESSENTIALS.md — the twelve rules distilled from the full policy set, published on the handbook site. Delivery is a guided walkthrough run with /isms:onboard, on joining and annually thereafter: it presents the rules in three batches, asks scenario questions, collects any "that is not how it really works" remarks as findings, and appends the completion to the training log itself. No SaaS awareness tool is used; for a team of this size the walkthrough produces better evidence, because the findings raised are recorded alongside the completion.

4. Records (evidence)¶

Completion of awareness/training is recorded (who, what, when) — key audit evidence. Tracked in the Training & Awareness Log. Each row records date, person, activity, the material version (ESSENTIALS.md with the git SHA it was read at), the method, and any findings raised. /isms:onboard appends the row and opens a pull request, so the record is reviewed rather than self-asserted.

5. Roles¶

Olaf Jacobson (ISM) — owns the programme; ensures awareness is delivered and recorded.
Technical Lead (Thomas) — input on engineering competence/secure-development training.
All staff — complete assigned training; apply it.

Change log¶

Version	Date	Author	Comments
0.1	2026-06-25	Andrea Cardinali / ISMS	First draft — competence approach, awareness scope (incl. AI tooling), training programme, records. Delivery/tracking flagged TODO.
0.2	2026-10-16	Olaf Jacobson	Policies matched to practice (owner decisions 2026-10-16): one annual refresher (/isms:onboard) including secure coding, plus onboarding.