An ISO 27001 training plan is a short, documented answer to three questions: who needs which skills, how you will deliver them, and how you will prove they worked. The standard does not hand you a curriculum. It asks you to define the competence your people need, close the gaps, and keep evidence. This guide walks through building that plan, from the role matrix to the records an auditor will sample.
TL;DR
- Anchor the plan to three requirements: Clause 7.2 (competence), Clause 7.3 (awareness) and Annex A control A.6.3 (awareness, education and training), plus Clause 7.5 for the records.
- Build a role-based matrix. Developers, administrators, finance staff, executives, contractors and general users need different depth and different scenarios.
- Measure behavior and competence, not attendance alone: knowledge checks, scenario exercises, incident-reporting trends, policy acknowledgements.
- ISO sets no fixed pass score, course length or completion percentage. Any such number is your own internal target.
- Keep a lean evidence pack: the plan, schedule, materials, and participant names, content and dates.
Table of Contents
- What ISO 27001 actually requires from training
- Start with a needs assessment, not a course catalog
- Build the role-based training matrix
- Choose content that people can act on
- US financial firms: add the FFIEC layer
- Measure effectiveness, not attendance
- The evidence an auditor will sample
- A lean plan for startups and small teams
- When to schedule training in your ISO 27001 project
- Our perspective: training is where plans quietly fail
- Put training into your ISO 27001 estimate
- FAQ
- Sources
What ISO 27001 actually requires from training
The ISO/IEC 27001:2022 standard applies to organizations of any size and sector, and your implementation effort should scale with your context and resources. Training is no exception. Four pieces of the standard shape the plan:
| Requirement | What it asks of you | What the plan must show |
|---|---|---|
| Clause 7.2 Competence | Determine the competence people need, ensure they have it, act to close gaps, retain evidence | Role-based competence criteria and gap actions |
| Clause 7.3 Awareness | Make people aware of the policy, their contribution and the consequences of nonconformity | Awareness content and delivery for everyone in scope |
| Annex A control A.6.3 | Appropriate awareness, education and training, with regular updates, relevant to job function | A schedule with refreshers and role-specific modules |
| Clause 7.5 Documented information | Control and retain the records | A register entry and stored evidence |
The published text of the standard is where to read the exact wording of Clause 7. The ISO overview page confirms the overall scope.
Notice what is missing. The standard does not prescribe one universal course, an annual curriculum, a pass mark or a completion percentage. If your policy says “95% completion within 30 days”, that is a fine internal target. It is not an ISO requirement, and you should not tell an auditor it is.
Start with a needs assessment, not a course catalog
The ISACA implementation guide for ISO/IEC 27001:2022 recommends beginning with a needs assessment based on hazard potential. It then moves through topic introduction, sensitization, sustainability and effectiveness evaluation. That sequence is a good skeleton for a plan.
In practice, the needs assessment is a table you can build in an afternoon:
- List every role inside the ISMS scope, including contractors and temporary staff.
- For each role, note which assets and systems it touches and which risks from your risk assessment apply.
- Write the competence the role needs in one or two sentences. For example: “Can recognize and report a phishing attempt” for general staff, or “Can apply the secure development policy and review code for injection flaws” for developers.
- Compare against what people can do today. The difference is your training need.
This ties training directly to your risk assessment, which is the thread auditors follow. If a risk treatment says “staff will be trained”, the plan should show who, on what, and when.
Build the role-based training matrix
ISACA’s guidance points out that content should match the audience’s real exposure. A developer, a privileged administrator, a finance employee, an executive, a contractor and a general user should not receive identical depth or scenarios. A matrix makes that explicit.
| Audience | Core content | Role-specific content | Suggested cadence (internal target) |
|---|---|---|---|
| All staff | ISMS policy, acceptable use, phishing, incident reporting | Clear reporting route and who to call | At onboarding, then at least annually |
| Developers | Secure coding, secrets handling, change control | Threat scenarios from your own stack | Onboarding, then when tooling or risks change |
| Privileged administrators | Access control, logging, backup and recovery | Privileged-access procedures, incident escalation | Onboarding, then at least annually |
| Finance and operations | Invoice and payment fraud, social engineering | Executive impersonation, customer-data handling | Onboarding, then at least annually |
| Executives and managers | Their ISMS responsibilities, management review | Risk acceptance, phishing aimed at leaders | Annually, tied to management review |
| Contractors | Acceptable use, data handling, reporting | Scope limited to the systems they touch | Before access is granted |
The cadence column is a suggestion, not a rule from the standard. Choose what your risk justifies, write it down, and then follow it. An auditor will check the plan against what you actually did.
Include contractors and leaders
Two groups are often forgotten. Contractors with system access are within the ISMS scope and need the same basic awareness, delivered before access starts. Executives matter for a different reason: the FFIEC handbook notes that management priorities materially affect employee awareness and policy compliance. When leaders attend, own incidents openly and reward quick reporting of mistakes, the rest of the company follows.
Choose content that people can act on
A plan can be audit-ready and still useless if the content is a deck people click through. Keep these principles:
- Short and frequent. Secure Systems’ guide to training programs argues that people finish short modules between meetings rather than postponing long sessions, and that interactive simulations where employees make decisions work better than passive reading.
- Tied to your policies. Reference your own acceptable-use, incident and access-control policies, not generic ones. Annex A 6.3 asks for regular updates on your policy and procedures.
- Refreshed. Update scenarios when your tools, threats or ISMS scope change. A refresh after an incident is excellent evidence of continual improvement.
- Honest about reporting. Teach people that reporting a mistake quickly is the goal, not hiding it.
Typical core topics
For most organizations the common core covers phishing and social engineering, password and login practice, endpoint security, removable media and email data loss, clear desk and screen, remote working, and how to report an incident. Add role modules on top, using your risk assessment to decide what matters.
US financial firms: add the FFIEC layer
If you are a bank, credit union, lender or service provider to one, ISO 27001 training is not the only expectation. The FFIEC says training should ensure personnel have the knowledge and skills for their job functions, and should address endpoint security, login and password requirements, phishing, social engineering, email or removable-media data loss and inappropriate social-media disclosure. It also expects management to communicate responsibilities, hold employees, officers and contractors accountable, and collect signed acceptable-use acknowledgements as part of annual training.
A workable approach is to keep one plan and map both frameworks to it. Add finance modules for payment and invoice fraud, executive impersonation, customer-data handling, privileged access and incident escalation to the common core. Our ISO 27001 audit prep guide for finance companies covers the wider audit picture for this sector.
Measure effectiveness, not attendance
Clause 7.2 asks you to take action to acquire the competence and evaluate whether the action worked. Attendance alone shows only that someone sat in a session. ISACA lists useful measures you can choose from, depending on risk:
- Quiz or knowledge-check results, including a short check after each module.
- Simulated-phishing click and credential-entry rates.
- Incident ratios linked to misconduct or error.
- Learner feedback.
- Incident-reporting trends: a rise in early reports is often a good sign.
- Policy acknowledgements.
Pick a handful that match your risks. Then feed the results into your management review. The Clause 9.3 agenda guide shows how to map inputs like these to evidence.
One caution from ISACA’s guidance: simulated attacks should be ethical, proportionate and, where applicable, coordinated with employee representatives. Do not use phishing tests to shame individuals. Use them to find which scenarios need better teaching.
The evidence an auditor will sample
ISACA recommends documenting the training concept, schedule, materials and participant evidence, including names, content and dates. That list is your evidence pack. Keep it small and findable:
- The training plan itself: the matrix, the owner, the cadence and the effectiveness measures.
- Materials: slide decks, videos, quiz questions, with version and date.
- Delivery records: who attended or completed what, and when.
- Effectiveness results: quiz scores, phishing results, feedback and the actions you took.
- Gap actions: what you did about people who did not complete or did not pass.
- Acknowledgements: signed or recorded acceptance of key policies.
Register these as documented information so they are version-controlled and retrievable. Our guide to Clause 7.5 document control and evidence packs explains how, and the overview of types of evidence for ISO 27001 audits helps you judge what counts. Also check common audit failures; training records with gaps in names or dates are a classic.
A lean plan for startups and small teams
You do not need an enterprise program. ISO’s practical guide for SMEs frames implementation for organizations with limited resources. A lean plan can still pass if ownership, competence criteria, delivery, effectiveness evaluation and documented information are clear.
For a team of 15 to 50 people, that might be:
- One named owner, often the security lead or IT manager. See ISO 27001 roles for implementers for how to assign it.
- A one-page matrix with three or four audience groups.
- A 30 to 45 minute onboarding session plus a short annual refresher.
- A quarterly micro-lesson triggered by real events, such as a new phishing campaign.
- A single spreadsheet or tracker for records.
That is an internal sizing suggestion, not a standard requirement. What matters is that the plan is written, followed and reviewed.
When to schedule training in your ISO 27001 project
Training belongs early enough that staff can follow the processes before the audit samples them. Awareness for everyone should be delivered before the Stage 2 audit so there are real records to show, and role-specific training should follow the policies it teaches. Our project milestones guide lays out 12-week and 6 to 10 month timelines, and the certification checklist shows where training sits among the other steps. For what auditors sample at each stage, see audit stages and sample records.
Our perspective: training is where plans quietly fail
We see the same pattern when organizations estimate an ISO 27001 project. Technical controls get budget and attention. Training is penciled in as “an annual video” and then becomes the thing that produces a finding. The cause is rarely money. It is that nobody owned the competence question in Clause 7.2, so the records show attendance and nothing else.
Our advice is to treat training as a small project inside the larger one. Give it an owner, a time estimate and a place on the timeline, just like policy writing or the risk assessment. When you plan effort this way, you also see how little a lean plan costs compared with the rework after a nonconformity. Hours spent on role-based content and a tidy evidence pack are among the cheapest in the whole project.
And keep the matrix honest. If your plan says administrators get annual privileged-access training, make sure it happens and is recorded. A short plan you follow beats a long one you do not.
— Martin
Put training into your ISO 27001 estimate
Training hours, content creation and records upkeep are real effort, and they vary with company size, industry and security maturity. The ISMS Calculator gives a real-time estimate of ISO 27001 implementation cost and effort, with editable assumptions and model reference comparisons, and you can compare saved scenarios and plan phases on a timeline. If you first want to know where you stand, the free 2-minute readiness check is a quick start, and the full readiness assessment goes deeper across the ISO domains.
FAQ
Is a training plan mandatory for ISO 27001 certification?
The standard does not use the words “training plan”, but Clauses 7.2 and 7.3 and Annex A control A.6.3 require competence, awareness and training, with retained evidence. In practice a written plan is the simplest way to show that. Without one, you will struggle to demonstrate a planned approach.
How often should we run ISO 27001 security awareness training?
ISO does not set a frequency. Many organizations train at onboarding and at least annually, with extra sessions when risks, tools or policies change. Choose a cadence your risk justifies, document it, and follow it. US financial institutions should also check the FFIEC expectation of annual training.
Do we need accredited courses or certified trainers?
No, for staff awareness. Internal sessions are acceptable if the content fits your ISMS and you keep evidence. Accredited courses make sense for people who need deeper skills, such as internal auditors or implementers, because Clause 7.2 asks you to ensure competence for those roles.
What is a good pass score or completion rate?
The standard sets none. Pick an internal target, for example a quiz threshold and a completion deadline, and record what you do about people who miss it. An auditor will look at whether you follow your own rule.
What records will the auditor ask for?
Expect the plan, the materials, participant names with content and dates, and evidence of effectiveness such as quiz results or phishing trends. They may also ask how training fed into management review.
Sources
- ISO/IEC 27001:2022, ISO
- ISO/IEC 27001:2022 standard text
- ISACA implementation guide, ISO/IEC 27001:2022
- FFIEC IT Handbook, II.C.7(e) Training
- ISO practical guide for SMEs
- Secure Systems, cybersecurity training program guide