ISO 27001:2022 Annex A Control 6.3

What Is the Purpose of ISO 27001:2022 Annex A 6.3?

The goal of ISO 27001:2022 Annex A 6.3 is to guarantee that personnel and pertinent stakeholders are informed of and suitably educated to meet their info security obligations.

ISO 27001:2022 Annex A 6.3 details the range of activities necessary to ensure personnel possess the knowledge and abilities necessary to operate in the organisation’s information security framework. Primarily, this Annex A Control focuses on raising awareness of the significance of information security, advocating good practice, and encouraging conformity to relevant policies and regulations.

Annex A 6.3 Explained

Information security education, awareness, and training are essential components of an organisation’s risk management strategy and should be incorporated into the security policy. By providing employees with the knowledge and tools they need, organisations can ensure that their security measures are effective.

ISO 27001:2022 Annex A 6.3 outlines the necessity for businesses to have an information security awareness program to grant all personnel the appropriate knowledge and abilities to safeguard information resources. It gives advice regarding what should be included in a productive awareness program.

The organisation might need to provide security awareness training at least once a year, or as the risk assessment dictates, to all personnel with access to sensitive information assets or information systems that store, process, or transmit sensitive data.

What Is Involved and How to Meet the Requirements

Organisations must implement a process that ensures employees are adequately trained to perform their job duties safely and securely, without compromising information security. Training can be conducted in sessions, or through online resources such as videos or webinars. Annex A 6.3 dictates this.

Information security awareness, education, and training programmes should be developed in line with the organisation’s policy, topic-specific policies, and relevant security procedures. This should consider the information that needs protecting and the security controls in place to protect it, and should take place regularly.

Introducing awareness, education, and training to both new employees and those transitioning to roles needing different levels of security is beneficial.

An awareness campaign should comprise multiple activities to heighten understanding. This could involve campaigns, booklets, posters, newsletters, websites, information sessions, briefings, e-learning modules and e-mails.

Per Annex A 6.3, this program should encompass:

• Management is devoted to ensuring information security across the organisation.
• Familiarity with, and adherence to, the relevant information security procedures, including the security policy and any additional policies, regulations, laws, contracts and agreements concerning information security.
• Personal accountability for one’s own actions and inaction’s, responsibility for protecting information belonging to the organisation and its stakeholders; this is essential.
• Basic security procedures like information security event reporting (see Annex A 6.8) and baseline controls such as password security should be adhered to.
• Information security contact points and resources, including additional information security awareness materials.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 is not an entirely novel control. This version of ISO 27001, published in October 2022, updates the previous version ISO 27001:2013.

ISO 27001:2013 Annex A Control 7.2.2 lacks the attributes table and statement of purpose that are provided in ISO 27001:2022 Annex A Control 6.3.

Despite the variation in control numbers, there appears to be no other distinctions between the two Annex A Controls. While the wording of the two Annex A Controls varies, their meaning and purpose remain the same.

Annex A Control 6.3 was designed to be more user-friendly, enabling people to better understand its contents.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

Who Is in Charge of This Process?

This response hinges on your organisation. Many organisations’ security teams manage their information security consciousness, teaching, and training programmes. Some organisations, however, entrust the HR department or another branch to handle it.

Ensuring that somebody takes charge of formulating and executing your organisation’s security awareness program is vital. The information security manager should oversee this individual/department (if different from themselves).

This individual should possess sound knowledge of information security and be able to converse with staff regarding various security protocols. Furthermore, they should be able to create content for your training programmes and conduct recurrent training for personnel.

It is essential to comprehend that information security is not merely the duty of IT. All employees should be held accountable. Companies should create a team devoted to security, but they must also ensure everyone grasps the significance of confidentiality and reliability.

What Do These Changes Mean for You?

ISO 27001:2022 Annex A 6.3 is a revision of ISO 27001:2013 Annex A 7.2.2 and not a new Annex A Control. Consequently, most organisations won’t require to modify anything.

If you’ve already implemented the 2013 version of ISO 27001, you must evaluate whether these changes are pertinent to your company. Likewise, if you’re planning ISMS certification, you need to review your security processes to guarantee they meet the revised standard.

How ISMS.Online Helps

ISMS.online provides a comprehensive solution for ISO 27001:2022 implementation. It is a web-based platform that enables organisations to demonstrate their compliance with ISO 27001 standards through streamlined processes, procedures and checklists.

This platform not only facilitates the implementation of ISO 27001 but also provides an excellent resource for training personnel on information security best practices and documenting all efforts.

The benefits of using ISMS.Online are plentiful:

• This platform is easy to use and can be accessed from any device.
• It is fully adjustable to suit your requirements.
• Custom workflows and processes to suit your business requirements.
• Training resources to aid new staff members in attaining proficiency faster.
• The library contains templates for various documents, including policies, procedures, plans, and checklists.

ISMS.online streamlines the implementation of ISO 27001, offering all the resources, information and tools you need in one place. Just a few clicks of your mouse are all it takes to ensure your ISMS meets the standard.

Contact us now to arrange a demonstration.