Competence

Clause 7.2 requires organizations to determine the skills and experience needed for security roles, ensure staff possess them, fix any gaps through training, and keep evidence of this competence.

Competence requirements are determined by analyzing the specific tasks within the ISMS (e.g., risk assessment, auditing, system administration) and defining what education, training, or experience is needed to perform them effectively.

Required evidence includes CVs/resumes, degree certificates, industry certifications (e.g., CISSP, CISA), training attendance records, and results of competency evaluations.

A competency matrix is a document that lists key roles (rows) against required skills (columns), marking the required level of proficiency and the individual's current level, helping to identify gaps.

Document competence by maintaining up-to-date personnel files containing job descriptions, resumes, copies of certifications, training logs, and completed competency assessments. Tools like WatchDog Security's Compliance Center can centralize these competence artifacts by role, attach them to Clause 7.2 evidence tasks, and flag missing or expired records before an audit.

Auditors typically want more than a statement that 'people were trained'—they look for role-appropriate training, proof of completion, and some indication the learning was effective. A training platform helps by assigning required content by role, tracking completion, and keeping records that are easy to retrieve during an audit. For example, WatchDog Security's Security Awareness Training can assign role-based modules, track completion, and retain training records that support competence evidence for staff performing security-relevant work.

Contractor competence is often hard to evidence because documentation lives in email threads or vendor folders and gets outdated as people rotate on and off projects. A practical approach is to centralize contractor onboarding requirements, verify competence artifacts before access is granted, and retain an audit trail of what was checked and when. For example, WatchDog Security's Vendor Risk Management can maintain a vendor and contractor catalog, track required due-diligence items (including relevant qualifications), and keep status and evidence organized for audit review.

Competence (7.2) is about having the skill and ability to do a specific job (e.g., configuring a firewall). Awareness (7.3) is about knowing why security matters and what the general policies are (e.g., knowing not to share passwords).

Effectiveness is measured by evaluating if the person can perform the task correctly after training. This can be done via testing, observation by a supervisor, or reviewing the quality of their work output.

While general security awareness is required for all, specific competence training depends on the role. For example, developers may need secure coding training, while auditors need training on audit techniques.