01
Annex A 6.3 — information security awareness, education and training is a mandatory SoA control
ISO/IEC 27001 Awareness Training
Done-for-you ISO 27001 awareness training for your whole workforce
We deliver Annex A 6.3 awareness, education, and training across your workforce — covering the ISMS, information security policies, acceptable use, incident reporting, and role-specific modules. Managed rollout, audit-ready evidence accepted by certification bodies and customers. Live for your team in under a week.
- 100,000+ professionals trained
- Annex A 6.3 audit-ready
- Live for your team in 5 business days
admin.compliquest.com / iso-27001 / training
ISO 27001 Programme · Q2 2026
Training completion overview
847
Enrolled
92%
Completed
4.8★
Rating
0
Overdue
All Workforce Members
All Workforce Members
100%
IT & Security
IT & Security
96%
Developers & Engineers
Developers & Engineers
88%
Senior Management
Senior Management
74%
Audit-ready
Article 39 met
Records signed & timestamped
Certificate Issued
847 employees
4-WEEK ROLLOUT
RocheCoca-ColaSamsungHuaweiMicrosoftJPMorgan ChaseVolkswagenShellNestléSiemensBMWUnileverAXALufthansaPfizerAdidasRocheCoca-ColaSamsungHuaweiMicrosoftJPMorgan ChaseVolkswagenShellNestléSiemensBMWUnileverAXALufthansaPfizerAdidas
// why teams choose us
Why ISO 27001 awareness training is mandatory — not optional
ISO/IEC 27001:2022 makes information security awareness, education, and training a Statement-of-Applicability control at Annex A 6.3, with corresponding management-system requirements at Clauses 7.2 (Competence), 7.3 (Awareness), and 7.5 (Documented information). Certification bodies will not issue, maintain, or renew a certificate without evidence that all workforce members understand the ISMS, the information security policy, and their individual contribution. Customer audits, SOC 2 reviews, and procurement tenders typically require the same evidence.
02
Clause 7.2 (Competence) — staff must be competent for the work they perform within the ISMS
03
Clause 7.3 (Awareness) — all staff must be aware of the ISMS, the information security policy, and their contribution
04
Clause 7.5 — documented information must be available; training records are the primary evidence
02 — Curriculum
Role-based
by default.
Different roles face different risks. Training tailored to job responsibilities.
- 01All Workforce Members
All Workforce Members
- 02IT & Security
IT & Security
- 03Developers & Engineers
Developers & Engineers
- 04Senior Management
Senior Management
- 05Internal Auditors
Internal Auditors
- 06Vendor & Procurement
Vendor & Procurement
03 — Process
From kickoff to fully trained in under four weeks.
4
weeks avg.
92%
completion
- Week 1 · Discovery
Scope your risk
A 60-min working session with a specialist. We map your obligations, current training gaps, and regulator priorities in your jurisdiction.
- Compliance scan
- Regulator review
- Role-based gap analysis
- Week 2–3 · Build
Tailor & integrate
Your processes, contacts, and policies go into the modules. We brand the LMS, wire SSO, and connect HRIS so enrolment is automatic.
- Custom scenarios
- White-label LMS
- HRIS / SSO sync
- Week 4+ · Operate
Deploy & evidence
Roll out to all staff. Automated nudges hit non-completers. Manager dashboards in real time. Audit-ready records when regulators ask.
- Automated nudges
- Real-time dashboards
- Evidence pack
Ready to scope your programme?
Book a 30-min discovery call — no slides, no pitch, just specifics.
// platform & delivery
What every enterprise rollout includes
Managed rollout in 5 business days
Dedicated customer success manager handles enrolment, role mapping, kickoff communications, and reminder cadence.
Annex A 6.3 audit-ready evidence
Dated certificates per workforce member, exportable completion logs, and role-mapped curriculum records that satisfy stage 1 / stage 2 / surveillance audit checks under Clauses 7.2, 7.3, and 7.5.
Manager dashboard & reporting
Track completion across teams, business units, and ISMS scope boundaries. Export evidence packages for certification bodies, customer audits, and SOC 2 reviewers.
Single sign-on (SSO) & SCIM
SAML 2.0, OIDC, and SCIM provisioning. New joiners enrolled automatically. Leavers de-provisioned. Zero admin overhead.
Annual refresher cycle built-in
Multi-year licensing rolls workforce members forward each year. Refresher content tracks ISO/IEC 27002:2022 control updates and ISMS Forum guidance.
Custom modules & policy attestations
Your logo on certificates, co-branded learner emails, and the option to attach your information security policy, acceptable use, or incident response procedure to any module.
// from a customer
We pursued ISO 27001:2022 certification across our entire technology organisation. The certification body explicitly reviewed Annex A 6.3 evidence at stage 2. Role-mapped curriculum records and dated certificates passed without findings.
IM
ISMS Manager, Microsoft
Technology — 1,200+ workforce members trained
★★★★★
// by the numbers
Mandatory
for ISO 27001 certification
Lost
certification or qualified opinion
Procurement
increasingly requires ISO 27001
// frequently asked
Common questions.
Don't see your question? Send us a note — we usually reply same day.
Ask a questionISO 27001 is voluntary, but if you pursue certification then Annex A 6.3 (Information security awareness, education and training) is a Statement-of-Applicability checkpoint and Clauses 7.2/7.3 are management-system requirements. Certification bodies will not issue or maintain a certificate without evidence of staff training. The same evidence typically satisfies SOC 2 CC1.4 and customer audits.
Ready when you are
Ready to brief us on your team rollout?
Tell us your ISMS scope, your certification stage (pursuing, certified, surveillance), and your headcount. We'll come back with a curriculum proposal, pricing, and a rollout plan within 1 business day.
// programme summary
Time to deploy
4 weeks
Audience
All staff + role tiers
Languages
12 included
Updates
Quarterly, automatic
Pricing
Contact us for a quote