01
Annex A 6.3 — information security awareness, education and training is a mandatory SoA control
Loading...
We deliver Annex A 6.3 awareness, education, and training across your workforce — covering the ISMS, information security policies, acceptable use, incident reporting, and role-specific modules. Managed rollout, audit-ready evidence accepted by certification bodies and customers. Live for your team in under a week.
ISO/IEC 27001:2022 makes information security awareness, education, and training a Statement-of-Applicability control at Annex A 6.3, with corresponding management-system requirements at Clauses 7.2 (Competence), 7.3 (Awareness), and 7.5 (Documented information). Certification bodies will not issue, maintain, or renew a certificate without evidence that all workforce members understand the ISMS, the information security policy, and their individual contribution. Customer audits, SOC 2 reviews, and procurement tenders typically require the same evidence.
Annex A 6.3 — information security awareness, education and training is a mandatory SoA control
Clause 7.2 (Competence) — staff must be competent for the work they perform within the ISMS
Clause 7.3 (Awareness) — all staff must be aware of the ISMS, the information security policy, and their contribution
Clause 7.5 — documented information must be available; training records are the primary evidence
Different roles face different risks. Training tailored to job responsibilities.
A 60-min working session with a specialist. We map your obligations, current training gaps, and regulator priorities in your jurisdiction.
Your processes, contacts, and policies go into the modules. We brand the LMS, wire SSO, and connect HRIS so enrolment is automatic.
Roll out to all staff. Automated nudges hit non-completers. Manager dashboards in real time. Audit-ready records when regulators ask.
Ready to scope your programme?
Book a 30-min discovery call — no slides, no pitch, just specifics.
Dedicated customer success manager handles enrolment, role mapping, kickoff communications, and reminder cadence.
Dated certificates per workforce member, exportable completion logs, and role-mapped curriculum records that satisfy stage 1 / stage 2 / surveillance audit checks under Clauses 7.2, 7.3, and 7.5.
Track completion across teams, business units, and ISMS scope boundaries. Export evidence packages for certification bodies, customer audits, and SOC 2 reviewers.
SAML 2.0, OIDC, and SCIM provisioning. New joiners enrolled automatically. Leavers de-provisioned. Zero admin overhead.
Multi-year licensing rolls workforce members forward each year. Refresher content tracks ISO/IEC 27002:2022 control updates and ISMS Forum guidance.
Your logo on certificates, co-branded learner emails, and the option to attach your information security policy, acceptable use, or incident response procedure to any module.
We pursued ISO 27001:2022 certification across our entire technology organisation. The certification body explicitly reviewed Annex A 6.3 evidence at stage 2. Role-mapped curriculum records and dated certificates passed without findings.
Don't see your question? Send us a note — we usually reply same day.
Ask a questionTell us your ISMS scope, your certification stage (pursuing, certified, surveillance), and your headcount. We'll come back with a curriculum proposal, pricing, and a rollout plan within 1 business day.