Who needs ISO/IEC 27001 training? A role-by-role plan for your organisation

Ask a certification auditor what slows down an ISO/IEC 27001 audit and the answer is rarely technology. It is people. The auditor walks the floor, picks a developer, a receptionist, a finance officer and a team leader, and asks each one a simple question about their part in protecting information. Then the auditor asks the ISMS manager to show how the organisation decided what each of those people needed to know, and the evidence that they know it.

Organisations that answer quickly have one thing in common: a training plan built around roles, not around a single annual slide deck. This guide sets out that plan. It explains what ISO/IEC 27001:2022 expects from people at each level, which training builds that competence, and how to keep evidence that an auditor, a customer or a regulator can check in seconds. It is written for ISMS managers, HR and learning teams, and business owners preparing for certification or a surveillance audit.

Why one training session for everyone does not work

The standard does not ask for a fixed course or a fixed number of hours. It asks the organisation to decide what competence each role needs for information security, make sure people have it through education, training or experience, take action where there is a gap, and keep documented evidence. Separately, it expects everyone working under the organisation's control to be aware of the information security policy, how they contribute to the management system, and what happens when requirements are not followed.

That wording matters. A receptionist and a system administrator both need awareness, but only one of them needs to understand access control in depth. A risk owner needs to judge likelihood and impact and choose controls; an internal auditor needs to test whether those controls work. When every person receives the same one-hour presentation, the organisation over-trains some people and leaves serious gaps in others, and the auditor sees it immediately in the interviews.

Annex A of the 2022 edition reinforces the point. It groups its 93 controls into four themes: organisational, people, physical and technological, and one of the people controls calls for an information security awareness, education and training programme matched to each person's job. The programme is expected to be planned, relevant to the role and kept up to date as threats and policies change.

The five roles every ISMS needs to train

Most organisations, whatever their size, can map their people to five groups. The names vary, but the competence each group needs is remarkably consistent from a software company in London to a BPO in Manila or a laboratory in Singapore.

1. Every employee and contractor

Everyone who touches information needs the basics: recognising phishing and social engineering, choosing and protecting passwords, handling and classifying information, working safely from home and on the move, using removable media and cloud tools responsibly, and reporting a suspected incident without delay. They also need to know that the information security policy exists, where to find it and what is expected of them.

This is where most incidents start and where awareness pays back fastest. The right course is short, practical and repeated when people join and at regular intervals afterwards. On Sterling Academy, Information Security Essentials is built for exactly this group, with real situations from offices, factories and contact centres and a final exam that checks understanding rather than attendance.

2. Managers and process owners

Managers carry responsibility the standard places on leadership: making sure information security objectives are understood in their area, that resources are available, that their people follow the policy and that incidents and weaknesses are reported. They also approve access, sign off changes and are often the first to hear about a problem.

They do not need to become security specialists, but they do need to understand what the ISMS is, how risk drives the choice of controls, what the Statement of Applicability is and how audits work. ISO/IEC 27001:2022 Awareness gives managers that picture in plain business language, so they can lead their teams through certification rather than delegate it.

3. Risk owners and the ISMS manager

Risk assessment and treatment sit at the heart of ISO/IEC 27001. Someone has to identify information security risks, assess them consistently, decide how each one will be treated, choose the controls and justify every inclusion and exclusion in the Statement of Applicability. Auditors examine this work closely because every other part of the system depends on it.

The people who do it need method, not just awareness. ISMS Risk Assessment and Statement of Applicability walks through the full cycle with worked examples. For those who own specific controls, ISO/IEC 27002:2022 Information Security Controls explains what each control is for and what good implementation looks like, and Information Security Risk Management (ISO/IEC 27005) adds depth for teams that run risk assessment as a continuous process.

4. The ISMS core team

The core team builds and runs the system day to day: defining the context and scope, writing policies and procedures, setting objectives, running operational controls, measuring performance, managing nonconformities and preparing management review. In a smaller organisation this may be two or three people; in a larger one it is a cross-functional group from IT, HR, facilities, legal and operations.

This group needs the complete view of the standard, from context and leadership through to improvement, and the practical skills to turn requirements into records that work. ISO/IEC 27001:2022 Implementation Training is designed for them, following the order in which Sterling's experts take organisations through certification.

5. Internal auditors

Before the certification body arrives, the organisation must audit its own ISMS at planned intervals and report the results to management. Internal auditors need to plan an audit programme, prepare checklists from the standard and the organisation's own documents, interview people, sample records, judge evidence objectively and write findings that management can act on. They must also be impartial: they should not audit their own work.

ISO/IEC 27001 Internal Auditor Training builds these skills with realistic audit scenarios, so the internal audit finds the weaknesses before the certification auditor does.

A training plan by role, on one page

The table below turns the five groups into a plan that an HR or learning team can run and an auditor can follow.

The plan also makes budgeting easier. Instead of sending everyone on the longest course, each person takes only what the role needs, and the organisation can show why.

What counts as evidence of competence

The standard asks for documented information as evidence of competence, but it does not prescribe the format. In practice, auditors look for three things when they sample a person.

First, a clear statement of what the role requires: a competence matrix, job description or training needs analysis that links the role to information security responsibilities. Second, proof that the person meets it: a training record, a qualification or documented experience. Third, a sign that the organisation checks effectiveness: an exam result, an assessment, an observation or a review of performance after training.

Attendance sheets alone rarely satisfy the third point, because sitting in a room does not show that anyone learned anything. A course that ends with a final exam, and a numbered certificate that the auditor can verify online by scanning a QR code, answers all three questions at once: what was learned, by whom, when, and how well. Every Sterling Academy certificate carries a unique number and a QR code that opens its live record, so the evidence stands up on its own.

Five common mistakes, and how to avoid them

Training only the IT team. Many incidents begin with someone outside IT: a finance officer who pays a fake invoice, a recruiter who opens an infected CV, a site supervisor who lends a badge. Awareness has to reach every department, and every contractor working under your control.

Treating awareness as a once-a-year event. A yearly session is easy to schedule and easy to forget. New joiners who arrive the week after it may work for eleven months without any guidance. Tie awareness to onboarding and to changes in policy or systems, not only to the calendar.

Skipping the risk owners. Organisations often train the ISMS manager thoroughly and assume department heads will pick up risk assessment as they go. The result is inconsistent scoring, controls chosen out of habit and a Statement of Applicability nobody can explain in the audit.

Asking internal auditors to audit their own work. Small teams are tempted to let the person who wrote a procedure audit it. Train at least two people as internal auditors, from different areas, so each can audit the other's processes impartially.

Keeping records nobody can find. Certificates in personal inboxes and spreadsheets on one laptop fail at the worst moment. Keep every record in one place, linked to the person and the role, so the ISMS manager can answer an auditor's sample request on the spot.

Keeping the plan alive after certification

Certification is a starting point. Surveillance audits will sample people again, and the organisation itself changes: new joiners arrive, people change roles, new systems go live, and threats evolve. A plan that worked last year can quietly fall out of date.

Three habits keep it current. Build awareness training into onboarding so no one starts work without it. Review the competence matrix whenever a role or a process changes, not only once a year. And track completions in one place, so that the ISMS manager can see at a glance who is due, who is overdue and which certificates are ready to show the auditor. The Sterling Academy client dashboard lets an administrator assign each course only to the people whose role needs it, follow progress and download training records before the audit.

Bringing it together

ISO/IEC 27001 is often described as a technical standard, but its success depends on people knowing what to do and being able to show it. A role-based plan turns a vague requirement into a clear programme: everyone gets the awareness they need, the people with real responsibility get real skills, and the organisation keeps evidence that anyone can check.

Sterling Academy's information security courses follow that structure step by step, from essentials for every employee to internal auditor training, each ending with a final exam and a verifiable certificate. If you are training a team, you can assign each step to the right people and ask us for a bundle price for the whole path. Build the competence, and prove it with confidence.