# Building a training and awareness programme

How to work out who needs what training, deliver it, check it worked and keep records, for ISO 27001, ISO 9001, ISO 13485, UK GDPR and the EU AI Act.

Source: https://sted.digital/docs/guides/training-and-awareness · Last reviewed 17 October 2026 · Strand Guides

Work out what each role needs to know and do, plan induction, yearly refreshers and training on policy changes, and deliver it with content that fits. Check understanding, not just attendance, and record who completed what, on which version, and the result. Measure the programme with completion rates, phishing results and incident trends, and review it every year.

## When you need this

ISO 27001:2022 7.2 and ISO 9001:2015 7.2 ask you to decide the competence each role needs, provide it, check the action worked and keep evidence. ISO 27001:2022 7.3 and ISO 9001:2015 7.3 add awareness of the policy, of each person's contribution and of what happens if they do not conform. ISO 27001:2022 Annex A 6.3 adds regular updates. ISO 13485:2016 6.2 adds that the way you check training worked should be proportionate to the risk of the work.

UK GDPR Article 39(1)(b) makes staff training part of a data protection officer's role, and UK GDPR Article 32(4) expects people with access to personal data to act only on instructions. EU AI Act Article 4 requires providers and deployers of AI systems to take measures to support the development of AI literacy among their staff and others operating AI systems for them: the original duty, in force from 2 February 2025, asked for a sufficient level of literacy, and Regulation (EU) 2026/1744 reworded it from 27 July 2026 so that no particular level is required. HR or the compliance lead usually runs the programme.

This is guidance to help you understand the requirement, not legal advice.

## Before you start

You need a list of roles and the people in each, your approved policies and procedures, training records for the previous 12 months, and your incident and audit findings for the year. Agree a small budget, even if most content is free: the NCSC and the ICO both publish free staff training material for small organisations.

Planning a programme for a 40-person firm takes two or three days. Running it takes an hour or two per person per year, more for regulated roles.

## Steps

1. Analyse training needs by role: what each role must know and be able to do, and where current people fall short. Done when every role has a row in the training needs analysis.
2. Define the competence for each role and how you will check it. Done when each competence has a method of evaluation.
3. Plan the calendar: induction in the first week, an annual refresher, training when a policy changes and training after an incident that reveals a gap. Done when every trigger has an owner.
4. Choose the content for each need: your own policies, bought courses, or regulator material from the NCSC or the ICO. Done when each need has content and a format.
5. Deliver the training and assign each person the documents they must read. Done when every person has their assignments.
6. Check understanding with a quiz, a practical test, a simulation or an observed task, chosen by risk. Done when each result is recorded.
7. Record who completed what, on which version, on what date and with what result. Done when every completion has a record.

An administrator, or a Policy and Process Owner who owns the document, assigns and removes its trainees.
Training in Sted is the person's own attestation, on the current approved version, that they are aware of and understand the document and accept their role in it; nobody can complete it for someone else.
Training is completed against a specific approved version; a new version asks people to train again.
Re-issuing training on an unchanged version is not available yet.
A completed training record cannot be changed or deleted.

8. Measure the programme: completion rates, quiz or simulation results, and incidents caused by known gaps. Done when the figures are reported to management.
9. Review the programme at least once a year and after any significant change. Done when the plan for the following 12 months is approved.

## Awareness, competence and attestation

Auditors treat these as three different things, and a programme needs all three.

| Kind | What it shows | Evidence an auditor accepts |
|---|---|---|
| Awareness | People know the policy exists, why it matters to them and what to do | Interview answers, campaign records, phishing simulation results |
| Competence | People can do the job to the standard required | Qualifications, observed tasks, practical tests, the training needs analysis |
| Attestation | A person confirmed they read a specific version | A dated acknowledgement against that version |

A policy acknowledgement is an attestation. It proves the person saw the words, not that they understood or can apply them. An auditor who finds signed acknowledgements will still ask a developer what the secure development policy means for them, and a weak answer is a finding against ISO 27001:2022 7.3.

### Training that sticks

Short and frequent beats long and annual. Ten minutes on a real incident from your own sector, followed by two questions, does more than an hour of slides. Tie each module to something people do that week.

## Worked examples

### ISO 27001, an annual programme at a 40-person firm

A 40-person fintech runs its training needs analysis in January 2026 across five role groups: all staff, developers, system administrators, managers and finance. All staff get induction in week one and a refresher in March on phishing, multi-factor authentication, personal data and incident reporting (Annex A 6.3). Developers add secure coding, administrators privileged access, managers the leaver process, finance payment fraud.

The new information security policy, version 3, is approved on 2 February 2026, and 38 of 40 people attest within three weeks; two on leave complete on return. Quarterly phishing simulations fall from an 18% click rate in the first quarter of 2026 to 6% in the third, after short coaching for those who clicked. The training needs analysis, awareness campaign records and simulation results are the 7.2 and 7.3 evidence, and the annual review in December sets the 2027 plan.

### ISO 13485, a revised packaging inspection instruction

A device manufacturer approves version 4 of its sterile pouch seal inspection instruction on 10 June 2026. Six operators are trained by their supervisor from 15 to 17 June. Because a missed seal defect could harm a patient, the effectiveness check is proportionate to that risk (ISO 13485:2016 6.2): each operator inspects 20 seeded samples containing four defects, and must catch all four.

Five pass. One misses a defect, is retrained, and passes a fresh set on 19 June. Nobody inspects released product until they have passed. Each training record names the instruction version, the date, the result and the supervisor.

### ISO 9001, the same shape for quality roles

ISO 9001:2015 7.2 follows the ISO 13485 example, with the check chosen to suit the role rather than tied explicitly to device risk.

### UK GDPR, data handling for everyone with access

Under UK GDPR Article 32(4), everyone in the fintech who can reach customer data takes the personal data module, and the data protection officer reports completion under Article 39(1)(b).

### EU AI Act, AI literacy for a triage team

A HealthTech team deploying a triage model gives clinicians and support staff a session on what the model does, where it errs and when to override it, recorded as their EU AI Act Article 4 AI literacy measure.

## Checklist

- [ ] Every role has a row in the training needs analysis.
- [ ] Each competence has a method of checking it.
- [ ] Induction happens in the first week.
- [ ] Refreshers ran in the last 12 months.
- [ ] Policy changes triggered training on the new version.
- [ ] Understanding was checked, not only attendance.
- [ ] High-risk tasks had an effectiveness check proportionate to the risk.
- [ ] Records show the person, content, version, date and result.
- [ ] Programme measures were reported to management.
- [ ] The programme was reviewed in the last 12 months.

## How Sted helps

For ISO 27001 clause 7 Sted's knowledge base carries the Training Competence and Awareness Procedure (PRC-TCA) with its Training Record (REC-TR), Training Needs Analysis (REC-TNA) and Awareness Campaign Record (REC-AWC), and the Document Control Procedure (PRC-DCT) with its Document Review Record (REC-DCR) and External Document Control Record (REC-EDCR).
Records are part of the Full Management System plan.
Administrators and Policy and Process Owners see a training register of every person's training across documents, filterable by status and document.
Completed training does not expire.
Re-issuing training on an unchanged version is not available yet.
Training is in Framework and Users and Full Management System.
33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.

Sted records who confirmed they read which approved version. Checking that people understood it and can apply it stays with you.

## Related standards

- [ISO 27001 support](/docs/standards/iso-27001/support): clauses 7.2 and 7.3 in context.
- [ISO 27001 people controls](/docs/standards/iso-27001/annex-a-people-controls): control 6.3 and induction.
- [Policy adoption and rollout](/docs/guides/policy-adoption-and-rollout): acknowledgement when a policy is first approved.
- [Approved document](/docs/glossary/approved-document): the version training is completed against.
- [Training](/docs/product/training): assigning trainees and reading the register in Sted.
- [Approval and versions](/docs/product/approval-and-versions): why a new version asks people to train again.

## Frequently asked questions

Q: What should a security awareness training programme cover?
A: Start with what causes most incidents at small firms: phishing, password and multi-factor authentication habits, handling personal data, reporting incidents quickly, and safe use of devices away from the office. Add role-specific topics for developers, administrators, finance and managers. Refresh it at least once a year and after any incident that shows a gap.

Q: What goes in a training needs analysis?
A: One row per role: the competence the role needs, the training or experience that provides it, how you will check it, and how often it is refreshed. Note the gap for each current person in that role. ISO 27001:2022 7.2 and ISO 9001:2015 7.2 both expect this kind of record.

Q: Do all staff need GDPR training?
A: Everyone who handles personal data needs to know how to handle it, and UK GDPR Article 32(4) expects you to make sure they act only on your instructions. Short, role-relevant training at induction and once a year is the usual way to show it. People who never touch personal data need only the basics, such as reporting a suspected breach.