ISO 27001 security awareness training requirements (A.6.3, 7.2, 7.3)
What ISO/IEC 27001:2022 asks for on awareness, education and training (Annex A 6.3, clauses 7.2 and 7.3), what auditors look for, and the evidence a simulation programme can add.
ISO/IEC 27001:2022 asks for awareness in two places: the mandatory clauses 7.2 and 7.3, and the Annex A control 6.3, “Information security awareness, education and training”. The standard does not name phishing simulation. This post paraphrases what each part asks for, what auditors typically look for, and how a continuous simulation programme can add evidence. Because the standard is licensed, buy a copy from ISO or a national body for the exact wording.
Key takeaway
Clauses 7.2 and 7.3 are mandatory for every ISMS that claims conformity. Annex A 6.3 is chosen through your risk treatment and recorded in your Statement of Applicability. None of them name phishing simulation.
What the clauses ask for
| Detail | What it asks (paraphrased) |
|---|---|
| Annex A 6.3 | Personnel and relevant interested parties receive appropriate awareness, education and training, and regular updates of the information security policy and topic-specific policies and procedures, as relevant for their job function. |
| Clause 7.3 | Personnel doing work under the organisation’s control must be aware of the information security policy, of their contribution to the effectiveness of the ISMS, and of the implications of not conforming with its requirements. |
| Clause 7.2 | Determine the competence people need; ensure they are competent through education, training or experience; take actions to acquire competence and evaluate how effective those actions are; retain documented information as evidence of competence. |
Clauses 4 to 10, including 7.2 and 7.3, apply to every ISMS that claims conformity. The Annex A controls are chosen through your risk treatment; if you leave 6.3 out, you record a justification in the Statement of Applicability.
What auditors look for
Auditors often ask for a training plan that covers roles, records of who was trained and when, and evidence that you evaluated whether the training worked (clause 7.2). Dated campaign reports, completion records for people who clicked, and a trend report over time are the kind of documented information that can go into those records. Policy acknowledgement for clause 7.3(a) is usually a separate process.
Why phishing simulation helps (and what the text says)
Clause 7.2 asks you to evaluate how effective your actions are and to retain documented information as evidence. Recurring simulations give dated, measurable results: who was tested, on which attack, whether they finished the lesson, and whether exposure is falling by department. That is evidence for the awareness and competence parts, not a claim that the standard requires simulation.
The standard does not name phishing simulation, a frequency or a format. What counts as appropriate is for you to decide and justify in your risk treatment, and for your certification auditor to assess.
Evidence checklist
- Campaign reports and per-person completion records (Annex A 6.3).
- Results by department and an executive trend report (clause 7.2 effectiveness).
- Dated exports (PPT, PDF, CSV) and an interaction audit trail for the ISMS records (clause 7.2 documented information).
- Your own process for policy acknowledgement (clause 7.3); a phishing lesson does not replace that.
How SecurityRing helps
SecurityRing gives dated campaign reports, completion records and trend exports for the phishing and deepfake awareness part of Annex A 6.3 and clause 7.2. It does not record policy acknowledgement, it is not an ISO certification, and ISO does not endorse it. Your certification body decides whether the evidence is enough.
Sources
Every clause, incident and figure above comes from these official or original sources.
- ISOISO/IEC 27001:2022 Information security management systems — RequirementsPublished 25 October 2022 · Accessed 16 October 2026.
