The Definitive Governance Requirement.
Clause 7.3 mandates that persons doing work under your control must be aware of the information security policy, their contribution to the effectiveness of the ISMS, and the implications of not conforming. You can build the strongest digital fortress in the world, but if an employee opens the gate for a hacker because they “didn’t know better,” your investment is void.
The Mandate
Competence (Clause 7.2) is about skill. Awareness (Clause 7.3) is about culture.
The standard requires that every single person under your control—employees, contractors, and embedded third parties—must know four things:
- The Policy: They don’t need to memorize it, but they must know it exists and where to find it.
- Their Contribution: They must understand how their specific job creates security (or vulnerability).
- The Benefits: Why does security matter? (e.g., “It keeps clients trusting us”).
- The Consequences: What happens if they fail? This includes disciplinary action, legal liability, and damage to the firm.
The Verdict: Ignorance is not a legal defense. If an employee claims they breached a protocol because “nobody told them,” the failure lies with the organization, not the individual.
The Implementation Strategy
Do not rely on a “Sign Here” sheet during onboarding. That is compliance theater. You need a campaign.
- The Onboarding Gate: No access to systems until the Awareness Induction is complete. Period.
- The Continuous Drip: Awareness fades. You must reinforce it. Use newsletters, Slack/Teams prompts, and Town Hall updates.
- Simulation: Testing awareness is better than teaching it. Run Phishing Simulations. If they click, they need re-training.
- Tailored Messaging: The awareness needs of a Developer (Secure Coding) differ from HR (Data Privacy). Segment your audience.
The Auditor’s Trap
[The Auditor’s View] The most common Major Non-Conformance here is “The Corridor Test.” During the audit, I will ignore your CISO and walk up to the Receptionist or a Junior Sales Associate. I will ask: “What are your responsibilities for information security?”
If they answer “I don’t know, ask IT,” you fail. They must be able to articulate basic concepts like “I lock my screen,” “I report suspicious emails,” and “I protect client data.”
Required Evidence
An auditor looks for proof of engagement, not just attendance.
- Induction Records: Signed checklists from new hires acknowledging the policy.
- Training Logs: Records of completed awareness modules (e.g., KnowBe4, Phished.io, or internal decks).
- Communication Evidence: Copies of emails, posters, or intranet posts regarding security updates.
- Testing Results: Metrics from phishing simulations showing trends in user behavior.
Strategic Acceleration
Creating engaging awareness content is a full-time job. Most internal training decks are unreadable and ignored by staff.
The Hightable™ Awareness Training Pack provides the slide decks, the quizzes, and the communication templates required to meet Clause 7.3 immediately. It turns “Requirement” into “Culture” without the creative overhead.
The Next Move: Deploy the Awareness Pack