{"id":4540,"date":"2014-05-19T20:38:48","date_gmt":"2014-05-19T20:38:48","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/27001academy\/blog\/014\/05\/19\/how-to-perform-training-awareness-for-iso-27001-and-iso-22301\/"},"modified":"2026-01-16T08:01:11","modified_gmt":"2026-01-16T08:01:11","slug":"how-to-perform-training-awareness-for-iso-27001-and-iso-22301","status":"publish","type":"post","link":"https:\/\/staging.advisera.com\/27001academy\/blog\/2014\/05\/19\/how-to-perform-training-awareness-for-iso-27001-and-iso-22301\/","title":{"rendered":"How to perform training & awareness for ISO 27001 and ISO 22301"},"content":{"rendered":"

Most of the information security\/business continuity practitioners I speak with have the same problem: the employees in their companies don\u2019t take them seriously \u2013 not only the top managers, but also their peers.<\/p>\n

This is due to the fact that the employees usually do not understand what information security or business continuity is all about \u2013 in other words, you may have perfect policies and procedures, but simply pushing those to your internal email list won\u2019t help. You need to explain to your colleagues why information security and business continuity are needed, and how to perform certain tasks \u2013 that\u2019s the main purpose of ISO 27001 awareness and training.<\/p>\n

\n
The training cycle in ISO 27001 and ISO 22301:<\/div>\n
\n
    \n
  1. Define which knowledge and skills are required.<\/li>\n
  2. Perform trainings to reach the desired level.<\/li>\n
  3. Measure whether each individual has achieved the desired level.<\/li>\n<\/ol>\n<\/div>\n<\/div>\n

    The training cycle<\/h2>\n

    Both ISO 27001<\/a> and ISO 22301<\/a> require you to deal with training in a systematic manner, i.e. to perform these steps:
    \n\"ISO<\/p>\n

      \n
    1. Define which knowledge and skills<\/strong> are required<\/strong> for particular personnel who have a role in your information security management system (ISMS) or business continuity management system (BCMS) \u2013 basically, you need to go through every ISMS or BCMS document and see what knowledge and skills are required of every responsible person mentioned in the document.<\/li>\n
    2. Perform trainings<\/strong> to reach the desired level<\/strong> of knowledge and skills \u2013 see below for methods.<\/li>\n
    3. Measure whether each individual has achieved the desired level<\/strong> of knowledge and skills \u2013 through testing, interviews, etc. \u2013 once you know where the gaps are, you can start again with step #1.<\/li>\n<\/ol>\n

      And this is something that needs to be done continuously \u2013 either by the CISO \/ business continuity coordinator, or by the HR department.
      \n

      <\/div>