{"id":43095,"date":"2026-07-01T11:35:17","date_gmt":"2026-07-01T09:35:17","guid":{"rendered":"https:\/\/smartfense.com\/?p=43095"},"modified":"2026-07-01T12:13:09","modified_gmt":"2026-07-01T10:13:09","slug":"iso-27001-2022-control-6-3-awareness","status":"publish","type":"post","link":"https:\/\/smartfense.com\/en\/blog\/iso-27001-2022-control-6-3-awareness\/","title":{"rendered":"What ISO 27001:2022 control 6.3 requires on awareness and how to prove it"},"content":{"rendered":"

The October 2022 revision of ISO\/IEC 27001 fully reorganized Annex A, and the window for certified organizations to migrate from the 2013 version closed on 31 October 2025. Anyone certifying or renewing today does so on the new version. In that reorganization, the awareness control changed its number, its grouping and, above all, its evidentiary bar.<\/p>\n

This piece does not explain what ISO 27001 is or how to get certified. It assumes you already have that covered. It focuses on something narrower, namely what control 6.3 says about staff awareness, what changed compared to 2013, and what an organization has to be able to show once the auditor starts asking for evidence.<\/p>\n

What does control 6.3 of ISO 27001:2022 require on awareness?<\/h2>\n

Control 6.3 of Annex A, \u00abInformation security awareness, education and training\u00bb, requires that all of the organization\u2019s personnel (and, where relevant, the third parties involved) receive adequate, up-to-date training on the security policies and on their role within them. It sits inside the People theme, one of the four groupings of the new standard.<\/p>\n

The weight is carried by three words in the wording. \u00abAdequate\u00bb means the content has to match each person\u2019s function and the real risks of the role, not a generic syllabus. \u00abUp-to-date\u00bb means the training keeps pace with changes in policies and in the threat landscape. And \u00aball personnel\u00bb closes the door on programs that only reach part of the workforce. The control describes a living process, sustained over time and revisited whenever the context changes.<\/p>\n

The 6.3 does not stand alone either. It rests on control 6.2, which governs the terms and conditions of employment, and on the security policies that management approves under control 5.1. Training is the mechanism by which those policies stop being a document and become behavior. An auditor reviewing 6.3 almost always checks, in parallel, that there is a policy the training refers to and that the policy is current.<\/p>\n

Who is covered by control 6.3 training?<\/h2>\n

All of the organization\u2019s personnel, regardless of function or seniority, and third parties with access to information or systems where that access warrants it. The control does not allow the logic of training only the technical teams or those who handle sensitive data. Awareness is understood as a layer of protection that covers the entire organization.<\/p>\n

Three groups are worth treating separately, because they are the ones the auditor reviews in most detail. General staff need a common baseline on policies, common threats and how to report an incident. Higher-exposure roles, such as systems administration, finance or customer service, require content specific to the risks of their function. And management falls into a category of its own, because it approves the policies and answers for them, so its training has to go beyond the general message. Leaving the leadership layer out of the program is one of the gaps an audit detects fastest.<\/p>\n

What changed between ISO 27001:2013 and the 2022 version on awareness?<\/h2>\n

The underlying requirement did not transform, but its placement and its reading did. In 2013, awareness lived in control A.7.2.2, within a domain dedicated to human resources. In 2022 it became control 6.3 of the People theme, a reorganization that brings it closer to other controls on behavior and individual responsibility.<\/p>\n\n\n\n\n\n\n\n\n
Aspect<\/th>\nISO 27001:2013<\/th>\nISO 27001:2022<\/th>\n<\/tr>\n<\/thead>\n
Awareness control<\/td>\nA.7.2.2<\/td>\n6.3<\/td>\n<\/tr>\n
Grouping<\/td>\nDomain 7, human resource security<\/td>\nPeople theme<\/td>\n<\/tr>\n
Total Annex A controls<\/td>\n114<\/td>\n93 (11 of them new)<\/td>\n<\/tr>\n
Annex A structure<\/td>\n14 domains<\/td>\n4 themes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The change that matters most for an awareness program is not in the text of 6.3, but in the context. The 2022 version added new controls oriented toward conduct and the use of technology, and that raises the auditor\u2019s expectation of what \u00abraising awareness\u00bb means. Showing that people know is no longer enough when the standard, as a whole, turns toward being able to show that people act differently.<\/p>\n

How is compliance with control 6.3 evidenced in an audit?<\/h2>\n

An auditor is not satisfied with seeing that a course exists. It asks for a trail. The evidence that supports control 6.3 usually rests on these elements:<\/p>\n