ISO 27001 Clause 7.2: Competence

The competence of a member of staff to fulfil their roles and responsibilities is important when it comes to the implementation of an ISMS. To ensure the successful implementation of the ISMS, this clause requires the organisation to determine the competence of staff members working on the ISMS who can affect its performance. Their competence is based on their education, knowledge, skills, training and experience.

The organisation must take appropriate actions to ensure the ISMS competence of its personnel by conducting training, and then evaluating the before and after difference in performance. Training workshops can be really helpful in bridging the gap in competency or in gaining new skills. The organisation also needs to retain documented information as evidence of competence.

ISO 27001 competence matrix

A simple matrix can help senior leadership keep track of the competence levels across the organisation’s ISMS-associated staff. This should include the names of all the individuals involved, their roles and responsibilities regarding the ISMS, and a list of skills, knowledge or experience that they require. This could be software proficiency, knowledge of a process, or experience in a particular area, among others.

The senior leadership should then assess each member of staff’s competency in each of these areas with a level, such as ‘basic’, ‘competent’, ‘advanced’ or ‘none’ to analyse any training gaps.

If, after the analysis of competency and the implementation of any necessary training, staff are still not seen as competent, then solutions such as changing their roles and responsibilities can be considered.