ISO 27001 and ISO 22301 Training and Awareness That Works

Security and continuity learning often fails in a predictable way: everyone receives the same annual presentation, attendance reaches a high percentage, and the organisation cannot show that people can perform their roles during a real incident.

ISO/IEC 27001 and ISO 22301 both require attention to competence and awareness. Neither prescribes one course or a fixed frequency. An effective programme starts from risk and role requirements, teaches people what they must know and do, and evaluates whether behaviour and capability improved.

The efficient approach is one coordinated learning system with distinct outcomes for information security and business continuity.

Separate awareness from competence

Awareness answers why a subject matters and what every person is expected to recognise or report. Competence is the demonstrated ability to perform an assigned task.

General awareness may cover:

• security and continuity policies;
• personal contribution to management-system effectiveness;
• consequences of failing to follow agreed arrangements;
• how to report suspicious activity or disruption;
• acceptable use of information and systems; and
• where to find trusted instructions during an incident.

Role competence is more specific. An incident commander must direct a coordinated response. A system administrator must restore services securely. A communications lead must issue accurate messages through approved channels. A service owner must decide recovery priorities.

Attendance can support evidence that information was delivered. It does not by itself prove competence or changed behaviour.

Build the programme from risks and roles

Start with the organisation’s scope, risk assessments, business impact analysis, plans, control responsibilities and lessons from incidents. Derive learning needs from work people actually perform.

The roles and responsibilities guide can help identify accountable owners before learning needs are assigned.

Create role groups that are meaningful in your environment, such as:

• all personnel;
• executives and crisis leaders;
• service and process owners;
• incident responders;
• ICT recovery staff;
• developers and change teams;
• privileged administrators;
• physical security and facilities staff;
• procurement and supplier managers;
• customer communications teams; and
• internal auditors.

A person may belong to several groups. Learning records should show the complete assignment.

Define observable outcomes

Replace vague goals such as “understand phishing” with outcomes that can be observed:

• recognise and report a suspicious message through the approved channel;
• activate the continuity plan using defined authority;
• use emergency access without bypassing logging;
• restore a service in the approved dependency order;
• protect personal and confidential information during manual operation;
• escalate a supplier interruption within the required window; or
• record decisions and evidence during a response.

Observable outcomes make delivery and evaluation easier. They also expose where policy language is too abstract to support action.

Use one learning matrix

A controlled matrix can connect:

Field	Purpose
Role or audience	Identifies who needs the capability
Risk or obligation	Explains why it matters
Required outcome	States what the learner must know or do
Delivery method	Matches the complexity and context
Timing or trigger	Defines when learning occurs
Owner	Assigns accountability
Evaluation method	Shows how effectiveness will be judged
Evidence	Identifies retained records
Review trigger	Keeps content current

This matrix is AuditPrepared guidance, not a prescribed ISO record. Use it only if it improves control.

Choose delivery methods that fit the outcome

Different outcomes need different methods.

Short awareness communications

Use concise messages for a new reporting channel, seasonal threat or policy change. Repetition can be useful, but messages should lead to a clear action.

Facilitated role sessions

Use discussion and case analysis when people must interpret policy, make trade-offs or coordinate across teams.

Technical practice

Use hands-on work for recovery, secure configuration, evidence preservation, emergency access and system operation. Technical competence cannot be inferred from a slide deck.

Exercises and simulations

Use realistic scenarios to test decision making, escalation, communication and cross-team coordination. Combine cyber and disruption conditions where they could occur together.

Coaching and observation

For specialist roles, supervised performance and peer review may provide stronger evidence than a quiz.

The incident management evidence guide explains the operating records that capable responders should produce.

Set useful triggers

Annual delivery may be appropriate for some general awareness, but risk should determine timing. Triggers can include:

• joining or changing role;
• receiving privileged access;
• approval of a new or revised policy;
• a new threat or material vulnerability;
• significant technology or process change;
• a failed exercise or actual incident;
• a supplier or regulatory change; and
• evidence of weak behaviour.

Avoid unnecessary repetition. If the same audience repeatedly demonstrates the outcome, focus effort on changed risks, weak roles and new joiners.

Evaluate effectiveness in layers

Evaluation should go beyond completion.

Layer 1: participation

Confirm the intended population received the intervention. Reconcile learners to an authoritative workforce and contractor source.

Layer 2: knowledge

Use questions or discussion to test relevant understanding. Avoid predictable questions that reward memorisation.

Layer 3: performance

Observe the task in a simulation, exercise or supervised activity. Can the responder use the right channel, make the decision and preserve required evidence?

Layer 4: operational behaviour

Review whether people report events, follow access processes, protect data during disruption and complete assigned response actions.

Layer 5: risk outcome

Look for reduced recurrence, faster and more accurate escalation, better exercise performance or fewer material control failures. Be careful with attribution: one metric rarely proves that learning caused the outcome.

NIST SP 800-50 Rev. 1 recommends a life-cycle learning programme that encourages behaviour change and uses evaluation and metrics for improvement. It is guidance, not an ISO requirement.

Keep populations trustworthy

A 98% completion result is weak if contractors, temporary staff or recent transfers are missing from the denominator.

Reconcile:

• active personnel;
• in-scope contractors;
• role assignments;
• privileged access populations;
• exercise participants;
• completed learning; and
• approved exceptions or leave.

Investigate unmatched records and keep critical roles visible. One untrained incident commander can matter more than a small gap in a low-risk group.

Ownership

Shared governance prevents security and continuity teams from sending conflicting messages.

• Top management approves expectations and resources.
• Security defines security risks and required behaviours.
• Continuity defines response and recovery capabilities.
• Human resources or learning operations maintain population and delivery processes.
• Managers confirm role assignments and local competence.
• Technical owners evaluate specialist performance.
• Internal audit independently tests design, population and evidence.

The programme owner should coordinate, but outcome owners remain accountable for capability in their areas.

Retain evidence that can be tested

Useful records include:

• approved needs analysis;
• role-to-learning assignments;
• controlled learning content and version;
• delivery date and facilitator;
• authoritative target population;
• participation and approved exceptions;
• assessment or exercise results;
• observed weaknesses;
• actions, owners and due dates;
• effectiveness evaluation; and
• evidence of improvement.

Avoid retaining unnecessary personal data. Define access, retention and disposal for learning records.

Audit sampling

Build the sample from risk, not convenience. Include:

• a new joiner;
• a role changer;
• a privileged user;
• an incident responder;
• a continuity or crisis leader;
• a contractor;
• someone absent from the original session; and
• a person involved in a failed exercise or actual incident.

Trace each person’s required outcome to delivery and effectiveness evidence. Then select one high-risk role from the authoritative population and confirm it appears in the learning system. This two-way test can expose missing assignments.

The clause explainer can help connect competence and awareness to the wider ISMS.

Pass, partial and fail examples

Pass: The programme was risk-led and role-based. Populations reconciled, specialist roles practised realistic tasks, results drove improvement and content changed after incidents and business change.

Partial: General awareness was well controlled, but specialist competence relied mainly on attendance and several contractors were assigned late.

Fail: Everyone received the same annual presentation. The organisation could not identify who needed recovery training, and responders failed an exercise without follow-up.

These examples illustrate evidence maturity, not automatic audit outcomes.

Common weaknesses

Avoid:

• treating policy distribution as awareness;
• treating course attendance as competence;
• giving every role identical content;
• using a workforce population that excludes contractors;
• testing trivia rather than decisions and behaviour;
• running exercises without objectives;
• reporting only aggregate completion;
• failing to retrain after material change;
• ignoring failed results; or
• collecting records with no retention or access controls.

The readiness checker can help identify broader management-system gaps around learning and evidence.

Practical conclusion

One coordinated programme can support both ISO 27001 and ISO 22301 when it keeps the outcomes distinct. Use common governance, populations and records, then tailor learning to the real security and continuity responsibilities of each role.

Measure participation, but do not stop there. Test knowledge, observe performance, inspect operational behaviour and use results to improve capability. The strongest evidence is not a perfect attendance percentage; it is people performing important actions correctly when conditions are difficult.