Information Security Competence, Awareness and Training Procedure¶
Purpose. Ensures people doing work under Soon's control are competent and aware of their information security responsibilities (ISO/IEC 27001:2022 7.2, 7.3 and control A.6.3). Mandatory; addresses risk R-19 (phishing/social engineering) and R-06 (AI tooling use).
1. Competence (7.2)¶
- The ISM identifies the competences needed for ISMS roles (ISM, technical security lead, risk/asset owners, developers).
- Competence is met through experience, training or external support (e.g. the consultant). Gaps are addressed by training or hiring/contracting.
- Records of relevant qualifications/training are retained as evidence.
TODO(owner): confirm where competence records are kept.
2. Awareness (7.3 / A.6.3)¶
All personnel and contractors are made aware of: - The information security policy and their responsibilities under it. - How to recognise and report security events (phishing, lost devices, suspicious activity) via the Event Reporting Procedure. - Key day-to-day rules: acceptable use, BYOD/endpoint security, MFA/SSO, secure handling of customer data, and acceptable use of AI tools (no secrets/customer PII in consumer AI tools). - The consequences of not conforming.
3. Training programme¶
| Audience | Topic | When |
|---|---|---|
| All staff & contractors | Security awareness induction | On joining (part of onboarding / New Starter Checklist) |
| All staff & contractors | Refresher awareness (incl. phishing) | At least annually |
| Engineers | Secure development / secure coding (OWASP) | On joining + annually |
| All staff | Targeted updates after major changes/incidents | As needed |
Awareness material to be developed (ISMS-DOC-07-6 Awareness Training). TODO(owner):
choose delivery (e.g. short internal session/slides, or a SaaS awareness tool).
4. Records (evidence)¶
Completion of awareness/training is recorded (who, what, when) — key audit evidence.
Tracked via a competence development record (ISMS-DOC-07-5) / training log.
TODO(owner): confirm tracking method.
5. Roles¶
- ISM (Olaf) — owns the programme; ensures awareness is delivered and recorded.
- Technical Lead (Thomas) — input on engineering competence/secure-development training.
- All staff — complete assigned training; apply it.
Related documents¶
- Roles & Responsibilities
- Acceptable Use Policy (A.5.10)
- Event Reporting Procedure (A.6.8)
- Monitoring & Measurement — metric M9
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2026-06-25 | Andrea Cardinali / ISMS | First draft — competence approach, awareness scope (incl. AI tooling), training programme, records. Delivery/tracking flagged TODO. |