# ISO 27001 support, competence, awareness and documented information

Clause 7 in practice: resources, proof that people are competent and aware, planned communication, and documents and records kept under control.

Source: https://sted.digital/docs/standards/iso-27001/support · Last reviewed 17 October 2026 · Strand Standards and regulations

ISO 27001:2022 clause 7 is what keeps the ISMS running: enough resources (7.1), people who are competent for their security roles (7.2) and aware of the policy and their part in it (7.3), planned communication (7.4), and documented information that is created, approved and controlled (7.5).

## The requirement in plain English

**Resources (ISO 27001:2022 7.1).** You decide what the ISMS needs, in people, time, tools and money, and provide it.

**Competence (ISO 27001:2022 7.2).** You decide what competence each role that affects security needs, make sure people have it through education, training or experience, act where they do not, and check the action worked. You keep documented information as evidence of competence.

**Awareness (ISO 27001:2022 7.3).** Everyone working under your control knows the security policy, how they contribute to the ISMS and what happens if they do not follow it. Annex A turns this into a control for awareness, education and training (ISO 27001:2022 Annex A 6.3).

**Communication (ISO 27001:2022 7.4).** You decide what you need to communicate about security, inside and outside the organisation: what, when, with whom and how.

**Documented information (ISO 27001:2022 7.5).** You keep the [documented information](/docs/glossary/documented-information) the standard requires and whatever else you need (7.5.1). When you create or update it, you identify it, choose a sensible format and review and approve it (7.5.2). You control it so the right version is available where needed, protected, distributed, stored, changed under control, retained and disposed of, including documents from outside that you rely on (7.5.3).

### What the standard requires you to keep

| Clause | What you must keep |
|---|---|
| 4.3 | The ISMS scope |
| 5.2 | The information security policy |
| 6.1.2 and 6.1.3 | The risk assessment and risk treatment processes |
| 6.1.3 d) | The Statement of Applicability |
| 6.2 | Information security objectives |
| 7.2 | Evidence of competence |
| 7.5.1 | Anything else you decide the ISMS needs |
| 8.1 | Enough to show processes ran as planned |
| 8.2 and 8.3 | Risk assessment and risk treatment results |
| 9.1 | Monitoring and measurement results |
| 9.2.2 | The audit programme and audit results |
| 9.3.3 | Management review results |
| 10.2 | Nonconformities, actions taken and corrective action results |

Annex A controls you apply add more, such as documented operating procedures.

This is guidance to help you understand the requirement, not legal advice.

## What good looks like

A 35-person SaaS company keeps a role profile for each job that touches security: what the role must know and how that is shown. Engineers need secure coding knowledge, shown by a course and code review history; the support lead needs data handling and incident reporting; the security lead needs ISMS experience, shown by a qualification. An annual training needs analysis compares people against their profiles and plans the gaps.

Everyone reads and confirms the security policy and the acceptable use policy in their first week, and again when a new version is approved. A short phishing exercise runs each quarter and its results feed the next awareness session.

A one-page communication table says who tells customers about an incident, who talks to the regulator, how policy changes are announced and how staff report a suspected incident.

Every policy and procedure has an owner, a version, an approval date and a review date. Approved versions are the only ones staff can see; superseded versions are kept for history. Records such as audit reports and access reviews are protected from editing once closed. External documents, such as a customer's security schedule, sit in a register with their version and owner.

## Evidence an auditor expects

- **Evidence of competence** (required): role requirements plus proof for a sample of people; the auditor picks someone in a key role and asks how you know they are competent.
- **Training and awareness records**: usual evidence for 7.3 and Annex A 6.3; the auditor also asks staff directly what the policy says about reporting incidents.
- **Communication arrangements**: usual rather than mandatory; the auditor checks the arrangements match what happened in a recent incident or change.
- **Document control**: the auditor samples documents for owner, version, approval and review date, and checks staff see only current versions.
- **Records protection**: the auditor checks that closed records cannot be quietly changed and that retention periods are set.
- **External documents**: a register or equivalent for standards, contracts and supplier documents you depend on.

## Common mistakes

### Awareness mistaken for competence

Everyone completes the same annual course and the record is offered as proof of competence for every role. An auditor asks how the course shows a cloud engineer can harden a configuration. Define role requirements and keep evidence that matches them.

### Competence actions never checked

A training gap is found and someone attends a course, but nobody checks it worked. Clause 7.2 asks you to evaluate the effectiveness of the action. Record a short check, such as a review of their next piece of work.

### Every document treated as mandatory

Teams write dozens of procedures because they believe the standard demands them, then cannot keep them current. The mandatory list is short; everything else is your call under 7.5.1. Write what your people need to work consistently, and keep it current.

### Uncontrolled copies

Policies live in a shared drive, an intranet and email attachments, in three versions. The auditor finds the old one. Keep one controlled location and make everything else a link to it.

## How Sted helps

For ISO 27001 clause 7 Sted's knowledge base carries the Training Competence and Awareness Procedure (PRC-TCA) with its Training Record (REC-TR), Training Needs Analysis (REC-TNA) and Awareness Campaign Record (REC-AWC), and the Document Control Procedure (PRC-DCT) with its Document Review Record (REC-DCR) and External Document Control Record (REC-EDCR).
Records are part of the Full Management System plan.
Training is completed against a specific approved version; a new version asks people to train again.
Re-issuing training on an unchanged version is not available yet.
A completed training record cannot be changed or deleted.
Each revision records "Why this revision" and the changes; the PDF ends with a revision history of approved versions.
Administrators and a document's owner can open superseded versions from History.
Approving sets an effective date and a review date, which starts at the effective date plus the document's review frequency; a review task opens 30 days before the review date and turns overdue after it.

Training in Sted is each person confirming they have read and understood an approved version. Deciding what competence each role needs, and judging whether people have it, stays with you.

## Related guides and terms

- [Training and awareness programme](/docs/guides/training-and-awareness): planning competence and awareness work.
- [Document control](/docs/guides/document-control): versioning, approval and review in practice.
- [Leadership and the information security policy](/docs/standards/iso-27001/leadership): the policy everyone must be aware of.
- [Training in Sted](/docs/product/training): how people confirm they have read each approved version.
- [Annex A people controls](/docs/standards/iso-27001/annex-a-people-controls): screening, terms of employment and awareness training.

## Frequently asked questions

Q: Is a training record enough to prove competence for ISO 27001?
A: Not on its own. Clause 7.2 asks for evidence that people are competent through education, training or experience, so a CV, a qualification or a supervised period can count as much as a course. Training records show awareness well; competence for a technical role usually needs more.

Q: Does ISO 27001 require a communication plan?
A: No document is mandated, but clause 7.4 asks you to decide what you communicate, when, to whom and how. A one-page table covering incidents, policy changes, customer notifications and regulator contact is the usual answer.