ISO 27001 Clause 7.2 - Competence

The guidance that follows reflects URM's experience supporting organisations with ISO 27001 implementation, internal audits and certification readiness.  In our experience, difficulties with Clause 7.2 rarely arise because organisations do not value competent people.  More often, the challenge is translating that intention into clear role requirements, consistent assessments and evidence that can withstand scrutiny.

From a practical perspective, the Standard requires organisations to demonstrate 4 things:

• Determine the competency requirements for the different roles within the scope of your ISMS
• Measure the current level of competence against those requirements in terms of education, training and experience
• Ensure that any gaps identified between the required competency and the current competency are resolved
• Retain documented evidence of competence.  

Although these requirements seem straightforward, URM’s experience is that some organisations, especially those aligning with ISO 27001 for the first time, do not address them in a logical order.  A common pitfall is assuming that information security and ISO 27001 training and awareness sessions are sufficient to demonstrate competence.  Such training can give individuals a useful general understanding, but it does not automatically make them competent to fulfil the specific requirements of their roles.

The organisations that manage Clause 7.2 most effectively typically follow a structured approach to competence management.

‍

‍

A practical competence process follows four key steps: define the competence required for each role, assess individuals against those requirements, address and evaluate any gaps, and retain evidence of the results.  As auditors and consultants, we consistently find that organisations which follow this sequence are better able to demonstrate conformance during internal audits and certification assessments than those that focus primarily on training records alone.

We always recommend addressing the first bullet point above before anything else.  You need to know what the competency requirements of the role are because, without them, you will have nothing against which to assess whether people are competent.  

In our experience, organisations often begin by reviewing the qualifications or training records of existing personnel before clearly defining what each role requires.  This can lead to assessments being shaped around the person currently performing the role rather than the competence genuinely needed to perform it effectively.

So, what do we actually mean by competence?  In practice, most organisations assess competence across two broad areas.  The first relates to soft skills.  These include things like the ability to communicate, writing capabilities, leadership skills, and attention to detail to name just a few.  The second area is more specific to the role.  For example, if someone has the role of Database Manager, they would need to understand database architecture and design, including security architecture, data quality management, capacity planning, licence management, and incident management among others.  

Very few of the items listed above will be provided to someone through general information security training and awareness.  

It also needs to be possible to measure the requirements of the role.  For this reason, organisations typically express competence requirements in terms of experience, education, qualifications and relevant skills.  Returning to the Database Manager example, the role may require five or more years' experience managing the same type of database used by your organisation, together with a relevant degree, professional qualifications and evidence of specific technical expertise.  A number of soft skills would also form part of the competence requirements.

Defining competence requirements in this way provides objective criteria that can be used both when recruiting for a role and when assessing the competence of existing personnel.  Once those requirements have been established, the next step is to assess individuals against them and identify any gaps.

You will need a process for measuring personnel competence.  This is not a one-time exercise but an ongoing management activity that should be reviewed periodically to identify and respond to change.  ISO 27001 does not prescribe a fixed review frequency.  However, URM typically recommends reviewing competence at least annually and whenever material changes to roles, technologies, controls or responsibilities occur.

In our experience, competence requirements often evolve more quickly than organisations expect, particularly in technical roles where technologies, threats and working practices continue to change.  Someone who was fully competent a few years ago may not necessarily possess all the knowledge and skills needed today if their development has not kept pace with those changes.

This is why regular competence reviews are so important.  They help organisations identify situations where additional training, mentoring, qualifications or practical experience may be required to maintain competence.  Identifying these gaps leads directly to the third element of Clause 7.2: taking action to address them.

There are several ways to restore or improve someone's level of competence.  In practice, the most effective response is not always formal training.  We have seen competence gaps addressed more successfully through coaching, mentoring, supervised experience or changes to the way responsibilities are allocated, particularly where the gap relates to applying knowledge rather than acquiring it.

A development-based approach might include:

• Coaching – providing support for an individual on a 1:1 basis to enable them to improve in the competence area they are lacking, whether that be in terms of behaviour, skills, or performance
• Mentoring – placing the individual with another, more experienced operator with the view to transferring knowledge
• Job shadowing – similar to mentoring in that the individual can observe someone else who is skilled and experienced in the role
• Secondments – temporarily moving the individual into another role that provides them with relevant exposure to the skills required to enable accelerated learning.

Another approach we sometimes suggest is reviewing whether the role itself can be adjusted.  This might involve reallocating certain responsibilities to a more experienced colleague, simplifying aspects of the role, or redesigning activities to better match the competence available within the organisation.

There may also be opportunities to simplify processes associated with a role, as well as sharing responsibility for operating certain controls or processes across a team rather than with one individual, leveraging the strengths of the entire team to ensure that all competency requirements can be met.  

In addition, you could consider providing other means of support for the individual, such as:

• Providing access to subject matter experts who could provide advice and guidance
• Providing knowledge management tools such as checklists and playbooks
• Investing in technology and automation.  

Of course, if none of the above work, other steps can be taken such as succession planning, moving individuals into roles that they are competent to perform, and replacing them with more skilful individuals from within the workforce or even through the use of contractors or consultants.  

Ultimately, organisations need to ensure that competent personnel are performing the roles required to meet business objectives and support the effective operation of the ISMS.  From our experience, most organisations address competence gaps through one or more of four broad approaches:

• Developing the person
• Supporting the person
• Redesigning the work
• Replacing the individual.

The final point in the competence cycle is the need to retain documented evidence of competence.  This can include CVs, qualification and education certificates, training records, assessment results, performance reviews, observed work outputs and records of actions taken to address competence gaps.  As a CV records claims of knowledge and experience rather than providing direct evidence of competence, it should be supported by evidence demonstrating that the individual can meet the requirements of the role.

In practice, a simpler way to demonstrate conformance with Clause 7.2 is often to retain a record of the reviews undertaken each year.  This could be achieved using a spreadsheet which identifies the role, its requirements, the person fulfilling it, the date of their most recent review and the level of competence attained against those requirements.  Maintaining this record each year, alongside the process used to conduct the reviews, should provide sufficient evidence that the requirements of Clause 7.2 are being met.  

From our experience, the strongest evidence is usually simple, current and traceable.  A concise competence record linked to supporting evidence is generally more valuable than a large collection of certificates that does not demonstrate whether the individual can fulfil the requirements of the role.

Throughout our consultancy and audit work, we have found that organisations achieve the best results when competence is treated as an active management process rather than a certification exercise.  Keeping role requirements current, discussing competence openly and responding promptly to gaps helps make Clause 7.2 part of normal business practice.

By defining role requirements, assessing individuals against those requirements, addressing any gaps and retaining appropriate evidence, organisations can establish a structured and repeatable approach to demonstrating competence.  Beyond supporting ISO 27001 conformance, this process helps ensure that the right people, with the right skills and knowledge, are in place to protect the organisation's information assets and support its wider business objectives.