ISO 27001 · Step-by-step series · Article 4 of 7

ISO 27001 Clause 7: Support — Resources, Competence, Awareness and Documented Information

Clause 7 of ISO 27001:2022 is where the information security management system (ISMS) stops being a policy document and becomes something people can actually operate. It covers the resources you allocate, the competence you require from the people who touch security-relevant processes, the awareness you build across the whole workforce, how you communicate internally and externally, and how you control the documented information your ISMS depends on. Auditors treat clause 7 as a bridge: if it is weak, everything downstream — risk treatment, incident response, internal audit — tends to be weak too.

Structure of clause 7: a quick overview

Clause 7 is organized into five subclauses that build on each other:

• 7.1 Resources: determining and providing what the ISMS needs to be established, implemented, maintained and continually improved.
• 7.2 Competence: making sure the people whose work affects information security performance are competent to do it.
• 7.3 Awareness: ensuring everyone under the organization's control understands the security policy, their contribution to it, and the implications of non-compliance.
• 7.4 Communication: deciding what needs to be communicated about the ISMS, when, with whom, and how — internally and externally.
• 7.5 Documented information: creating, updating and controlling the documents and records the ISMS requires, both those mandated by the standard and those the organization decides it needs.

7.1 Resources: funding the ISMS beyond the audit date

Clause 7.1 requires the organization to determine and provide the resources needed for the ISMS — not just to pass the certification audit, but to establish, implement, maintain and continually improve it over time. This is deliberately broad: resources can mean people (a security officer, part-time champions in each department), budget (tooling, training, external consultants), infrastructure (logging systems, backup capacity, secure development environments) and time (hours allocated for risk assessments, internal audits, awareness sessions).

The most common failure mode under 7.1 is not the absence of resources at launch — most organizations invest reasonably well in the run-up to certification — but the gradual erosion of resourcing once the certificate is issued. An auditor reviewing a second or third surveillance audit will specifically look for evidence that resourcing has been sustained: has the security budget line survived a cost-cutting round? Is the person responsible for the ISMS still doing it as a real part of their job, or has the role quietly become symbolic?

7.2 Competence: proving people can do the security-relevant part of their job

Clause 7.2 requires the organization to determine the necessary competence of people doing work under its control that affects information security performance, ensure those people are competent based on appropriate education, training or experience, and retain documented information as evidence of that competence.

In practice this touches a wider group of people than most organizations initially assume. It is not limited to the security team — it includes system administrators who configure access controls, developers who write code that handles sensitive data, HR staff who process background checks and onboarding/offboarding, and anyone with privileged access to production systems. The four steps to demonstrate compliance are:

• Identify the roles whose work affects information security performance, not just formally titled "security" roles.
• Define the competence required for each of those roles — certifications, specific training, years of relevant experience, or a mix.
• Verify current competence against that definition, and identify gaps.
• Take action to close gaps — training, mentoring, hiring, or reassignment — and keep records of what was done and its effectiveness.

A frequent audit finding is a training matrix that lists courses completed but never evaluates whether the training was effective — that is, whether the person can actually apply what they learned. A brief post-training check (a short quiz, a practical exercise, or a manager sign-off after observing the person perform the task) closes this gap cheaply.

7.3 Awareness: from the security team to the whole organization

Clause 7.3 extends beyond competence and applies to everyone working under the organization's control — not only employees with a defined security role, but also, where relevant, contractors and temporary staff with access to the organization's information assets. The standard requires that these people be aware of:

• The information security policy — not necessarily memorized word for word, but understood in substance.
• Their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance for the organization.
• The implications of not conforming with the ISMS requirements — what could go wrong, and what the consequences are, both for the organization and potentially for them individually.

Awareness is where many ISMS implementations under-invest, because it is easy to satisfy the letter of the requirement with a single onboarding presentation and hard to satisfy the spirit of it with a workforce that genuinely internalizes secure behavior. Effective awareness programs tend to share three traits: they repeat key messages at intervals rather than once, they use role-specific framing (what phishing looks like for someone in finance is different from what it looks like for someone in engineering), and they measure outcomes — simulated phishing click rates, incident-reporting rates, quiz completion — rather than just attendance.

7.4 Communication: internal and external, planned rather than improvised

Clause 7.4 requires the organization to determine the need for internal and external communications relevant to the ISMS, covering: what to communicate, when to communicate it, with whom, how to communicate, and who communicates. This applies to routine communications (security policy updates, awareness bulletins, results of internal audits) as well as to less routine but higher-stakes communications, most notably breach notification.

7.5 Documented information: what the ISMS must have in writing

Clause 7.5 governs the documented information the ISMS requires — both the documents ISO 27001 explicitly mandates (the scope, the security policy, risk assessment and treatment methodology and results, the Statement of Applicability, competence records, and others referenced throughout the standard) and any additional documents the organization itself determines are necessary for the ISMS to be effective.

The clause splits into three practical requirements:

• 7.5.1 General: the documented information the ISMS must include, combining standard-mandated documents with organization-determined ones.
• 7.5.2 Creating and updating: when creating or updating documented information, ensuring appropriate identification (title, date, author, reference number), format (language, version, media) and review/approval for suitability and adequacy.
• 7.5.3 Control of documented information: ensuring documents are available and suitable for use where and when needed, and adequately protected — from loss of confidentiality, improper use, or loss of integrity. This includes distribution, access, retrieval, storage, preservation, version control and retention/disposition, and extends to documents of external origin that the organization determines are necessary for the ISMS (such as a supplier's security certification or a regulator's guidance document).

*Not a mandatory documented record under the standard's explicit list, but auditors will expect some evidence trail to demonstrate the requirement was actually implemented, not just intended.

Common audit findings on clause 7

These are the recurring issues auditors raise on clause 7 across ISMS implementations of varying maturity:

• 7.1 — Resourcing that quietly declines after certification: the security budget or headcount that was adequate at launch is reduced or reassigned by the second surveillance audit, with no documented re-assessment.
• 7.2 — Training completed but competence not verified: a course certificate exists, but there is no evidence the person can actually apply the skill in their role.
• 7.3 — Awareness limited to a single onboarding session: new hires get a one-time briefing; there is no recurring program, and long-tenured staff cannot explain their role in the ISMS.
• 7.4 — No defined external communication owner for incidents: the organization has an incident response plan but has not decided in advance who is authorized to talk to customers, regulators or the press if a breach occurs.
• 7.5 — Document register out of date: the master list of documented information does not match what is actually stored in the document management system, or superseded versions remain accessible instead of being archived.

Frequently asked questions about ISO 27001 clause 7

Does clause 7.3 awareness apply to contractors and temporary staff, not just employees?

Yes. Clause 7.3 applies to "persons doing work under the organization's control", which is broader than the payroll. If a contractor, temp worker or third-party support engineer has access to information assets within the ISMS scope, they need an appropriate level of awareness of the security policy, their contribution to it, and the consequences of non-conformance. The depth of awareness can be proportionate to their access level and duration of engagement, but it cannot be skipped entirely.

Is a training certificate enough to prove competence under clause 7.2?

A certificate is evidence of participation, not proof of competence. Clause 7.2 asks the organization to ensure the person is competent based on appropriate education, training or experience — and to retain evidence of that competence, not merely of attendance. Good practice is to pair the certificate with a brief practical verification: a supervised task, a scenario-based test, or a manager's sign-off after observing the person perform the relevant activity.

What is the difference between clause 7.4 communication and the Annex A communication-related controls?

Clause 7.4 is a management-system requirement: it obliges the organization to plan its ISMS-related communications (what, when, with whom, how, who). Annex A contains specific controls that communication planning often has to satisfy in practice — for example, controls on incident reporting (A.5.24-A.5.26) and on contact with authorities and special interest groups (A.5.5, A.5.6). Clause 7.4 is the planning obligation; the relevant Annex A controls, once selected in the Statement of Applicability, describe some of what that plan needs to cover.

Do we need a separate document for every piece of documented information under clause 7.5?

No. ISO 27001 does not prescribe a specific document structure or a one-document-per-requirement rule. Organizations can consolidate related documented information into fewer, well-organized documents (for example, combining the risk assessment methodology and the risk treatment methodology into a single procedure) as long as the content required by the standard is present, controlled, and identifiable. What matters is that documented information is created and maintained with proper identification, review and approval, and that it is available and protected as clause 7.5.3 requires — not the number of separate files.

How often should awareness training be refreshed under ISO 27001?

ISO 27001 does not set a fixed frequency for awareness refreshers. Clause 7.3 requires ongoing awareness, which in practice most organizations interpret as at least an annual refresher for the general workforce, supplemented by more frequent touchpoints — phishing simulations, short bulletins after relevant incidents or policy changes, and role-specific sessions for higher-risk functions such as system administrators or finance staff handling payment instructions. The right cadence is the one that keeps measured outcomes (click rates, incident reporting, quiz scores) trending in the right direction, not a fixed calendar rule.

Who is responsible for approving documented information changes under clause 7.5.2?

ISO 27001 does not name a specific role — it requires that documented information be reviewed and approved for suitability and adequacy when created or updated, and it is up to the organization to assign that authority. Common practice is for the document owner (often the process owner, such as the CISO for the risk treatment plan or an HR lead for onboarding/offboarding procedures) to approve routine updates, while material changes to core ISMS documents such as the scope, policy or Statement of Applicability typically require top management sign-off, given their direct link to clauses 5 and 6.

Expert ISO 27001 · Updated 2026-07-31 · ISO 27001 step-by-step series: Article 3 — Clause 6 · Article 5 — Clause 8