A.6.3
Information security awareness, education and training
People controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control provides ongoing awareness activities and role-based education/training so personnel and relevant external parties understand and apply the security policies, procedures, and responsibilities relevant to their work. Awareness gaps, processes, and working conditions can contribute to phishing, social engineering, and mistakes, so training complements technical and organizational safeguards. Refresh content as threats and policies change and measure effectiveness to support safe decisions and behavior in daily work.
Key checkpoints
- Is there an information security awareness and training plan covering all personnel and relevant external parties, backed by management approval and budget?
- Are new joiners given basic security training early in hiring/assignment, and do all personnel receive refresher training on a schedule set by the organization's risks, roles, policies, and applicable obligations?
- Is differentiated, specialized training provided according to job characteristics (developers, system administrators, personal data handlers, management, and so on)?
- Does the content reflect current threats (phishing, ransomware, social engineering) and policy/legal revisions, and is it refreshed periodically?
- Are completion and comprehension confirmed (attendance, assessment, acknowledgement), and are remedial actions taken for those who did not complete?
- Is the effectiveness of awareness and training activities measured (simulation results, incident trends, assessment scores), and are results fed into the next plan?
Implementation guidance
- Establish an annual training plan covering audiences (all personnel, new joiners, by role, external parties), frequency, methods (classroom/online/simulation), and content, and obtain management approval.
- Provide basic security training to new joiners early in assignment, and set and record the refresher schedule for all personnel based on risk, role, policy, and applicable obligations, with additional training when threats or duties change.
- Provide separate, role-specific in-depth training for high-risk roles such as development, operations, and personal data handling (secure coding, privilege management, data protection).
- Reflect current threat trends, real incident cases, and policy/legal revisions in the content and refresh it regularly.
- Reinforce awareness continuously through repeated and varied channels such as phishing simulations, quizzes, campaigns, and posters/newsletters.
- Record and manage completion status and comprehension, and run remedial procedures such as re-training for those who did not complete.
- Measure effectiveness using simulation results, incident trends, and assessment scores, and feed improvements into the next plan.
Evidence
- Annual information security training/awareness plan and management approval document
- Training content such as course materials, curricula, and slides
- Delivery records: attendance sheets, completion status, online course history
- Role-specific training materials (developers, administrators, personal data handlers) and completion records
- Phishing simulation scenarios and result reports
- Effectiveness measurement materials (assessment results, incident trend analysis, satisfaction surveys) and records of improvements applied
Nonconformity examples
- A training plan exists, but there are no delivery records or only some personnel completed it, so organization-wide awareness cannot be confirmed.
- New joiners are put to work for a long period without security training and do not know basic security rules.
- The same material is used every year, so current threats or policy/legal revisions are not reflected at all.
- Only general training is delivered, with no role-specific training for high-risk roles such as developers and system administrators.
- Only completion is tracked formally, with no confirmation of comprehension or remedial action for those who did not complete.
- There is no effectiveness measurement such as phishing simulations, so the effectiveness of awareness activities cannot be confirmed or improved.