ISO 27001 Clause 7.3: Awareness

Understand why employee awareness plays a key role in ISO 27001
Learn what teams must know about security policies and responsibilities
See how awareness supports a strong, security-focused culture

Information security is a shared responsibility. Everyone in an organisation has a role to play in protecting the organization's information assets. This is why ISO 27001, the international standard for information security management, requires organisations to raise awareness of information security among all staff.

ISO 27001 clause 7.3, titled "Awareness", sets out the requirements for raising information security awareness. This includes ensuring that all staff are aware of the importance of information security, the organisation's information security policy, and their own responsibilities in relation to information security.

ISO 27001 Clause 7.3 Awareness

Persons doing work under the organisation's control shall be aware of:

the information security policy;
their contribution to the effectiveness of the information security management system, including
the benefits of improved information security performance; and
the implications of not conforming with the information security management system requirements.

What is ISO 27001 Clause 7.3?

ISO 27001 clause 7.3 requires organizations to:

Raise awareness of the importance of information security among all employees.
Provide training to all staff on the organization's information security policies and procedures.
Ensure that staff understand their responsibilities in relation to information security.

It is crucial that through increasing awareness, you drive a risk-aware culture through changing mindsets as to how information security is considered in all aspects of day-to-day working.

Keep in mind that the individual in charge of overseeing the information security management system in an organization must have a clear understanding of various aspects:

Have they thoroughly read and comprehended the organization's information security policy?
Do they grasp the significance of consistently upholding and enhancing the ISMS?
Are they aware of the consequences of neglecting the ISMS and failing to meet ISO 27001 requirements?

External Content: YouTube Video

In order to be able to play the desired video, you agree that a connection to the servers of YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA is established. This transmits personal data (device and browser information (in particular the IP address and operating system) to the operator of the portal for usage analysis.

You can find more information about the handling of your personal data in our privacy policy.

How do you demonstrate awareness for ISO 27001 clause 7.3?

Organisations can demonstrate an awareness for ISO 27001 clause 7.3 by taking a number of steps, such as:

Conducting awareness training for all employees.
Communicating the organisation's information security policy to all staff.
Posting information security posters and reminders around the workplace.
Including information security in staff induction and performance reviews.
Conducting regular awareness assessments to ensure that staff are aware of their responsibilities.

Frequently asked questions

What does ISO 27001 Clause 7.3 require employees to be aware of?

Clause 7.3 requires employees to understand the information security policy, their role in protecting information, and the consequences of non-compliance.

In practice, this means your team should know how their actions affect security. They should recognize common risks, understand internal procedures, and feel responsible for protecting company and customer data. Awareness goes beyond reading a policy. It ensures employees can apply security principles in their daily work.

How can we demonstrate awareness during an ISO 27001 audit?

Auditors typically verify awareness through interviews, training records, and internal communication materials.

They may ask employees about security responsibilities, incident reporting procedures, or relevant policies. You should be able to provide evidence of completed training sessions, regular awareness initiatives, and updated materials.

The goal isn’t perfect memorization. Auditors want to see that security awareness is active, ongoing, and embedded in your culture.

Does Clause 7.3 apply to contractors and external partners?

Yes. Clause 7.3 applies to anyone working under your organization’s control who could impact information security.

This includes contractors, temporary staff, and sometimes key suppliers. If they access systems or handle sensitive data, they should understand your security expectations and relevant policies.

You define the appropriate level of awareness based on risk. What matters most is that responsibilities are clear and consistently communicated.