ISO 27001:2022 requires continuous awareness

The point is straightforward: under ISO/IEC 27001:2022, awareness is not satisfied by an annual course and an attendance sheet. Clause 7.3 defines what everyone under the organization’s control must know, and control 6.3 requires a formal, regular program aligned to role. When that is compared with empirical evidence, measuring only completion or clicks falls short, and isolated annual training looks weak for both audit and operations.

What changes when clause 7.3, control 6.3, and the evidence are read together

No single source in the material puts in one view what ISO/IEC 27001:2022 requires, what ISO/IEC 27002:2022 adds, and what studies show about real outcomes. Read side by side, the sources show that the regulatory obligation already exists, but the meaningful debate is about cadence, segmentation, and behavior metrics.

What ISO/IEC 27001:2022 clause 7.3 actually requires

Clause 7.3 does not simply ask for training. According to ISO 27001:2022, people under the organization’s control must know the information security policy, their contribution to the effectiveness of the ISMS, and the implications of not conforming with its requirements, as High Table, ISMS.online, and Qalea note when citing clause 7.3.

Whalemate’s reading is that this clause sets a minimum required level of awareness for everyone in scope, not a one-time activity. According to ISO27001.com and ISMS.online, that scope includes employees, contractors, and embedded third parties, as well as leadership, so leaving out executives or outsourced staff weakens both operations and compliance evidence.

What control 6.3 adds that 7.3 does not solve on its own

Control 6.3 of ISO/IEC 27002:2022 adds program structure. According to Aviso Consultancy, staff and relevant interested parties must receive appropriate information, awareness, education, and training, along with regular updates on policy, topic-specific policies, and procedures, according to their job function.

Whalemate’s reading is that this is where the key shift happens, from awareness as a general obligation to a formal program. According to ISMS.online, the program must be developed in line with the policy, topic-specific policies, and security procedures, and must also consider the information to be protected and the controls in place, which makes generic content that is the same for everyone insufficient.

Why annual training is not enough even if it satisfies the basic audit trail

Aviso Consultancy, in citing control 6.3, refers to regular updates according to job function. Cybersecurity Dive, meanwhile, summarizes evidence that found no correlation between annual security awareness training and fewer phishing failures, and also cites reviews where common methods did not significantly reduce the likelihood of falling for phishing.

Whalemate’s reading is that annual training can serve as minimal documentary evidence of coverage, but it falls short of the logic of 6.3 itself. If the standard calls for regular updates and role-based relevance, a single annual event tends to show requirement management, not reduction in human risk.

Continuous programs or training that does not move the needle?

Verizon cites a 12-month study in which, with regular training and testing, phishing vulnerability fell from 31.4% to 4.8%. In tension with that, the paper Anti-Phishing Training (Still) Does Not Work, published on arXiv, concludes that training produced no statistically significant improvements in either reduced clicks or reporting behavior.

Whalemate’s reading is that not every intervention labeled awareness produces the same effect. The positive signal appears when there is continuity and testing, according to Verizon, while the negative evidence questions training approaches that do not necessarily include sustained follow-up, context, or repeated intervention on behavior.

Does training recency matter more than training existence?

Keepnet Labs, summarizing findings from the Verizon DBIR, says employees who received phishing awareness training within the last 30 days were 4x more likely to report phishing attempts, at 21% versus 5%. NIST Beyond the Click, by contrast, says trained people are about 2% less likely to fall for phishing than those who do not receive training.

Whalemate’s reading is that being trained as a broad category says little. Recency appears to move reporting behavior more than the mere historical existence of a course, which pushes the discussion toward operational cadence, not just annual compliance.

What should be measured if clicks do not tell the whole story?

NIST says organizations use click rates from phishing simulations and reporting of simulated and real phishing to evaluate training effectiveness. Verizon, however, cites a survey where people who said they had received training performed slightly worse on later tests, and where 74% of those who got everything wrong said they felt secure against threats.

Whalemate’s reading is that measuring clicks helps, but it is not enough, and measuring perception can even mislead. A program can show high completion or self-confidence and still fail to improve real decisions, so compliance metrics should be separated from behavioral metrics, and satisfaction should not be used as a proxy for effectiveness.

Is role-based segmentation a good practice or an operational requirement?

UpGuard says a program aligned with 6.3 should start with risk assessment, segment audiences, and develop role-based content. Guardey and ManageEngine also recommend specific training for people with elevated responsibilities or privileged access, along with regular content updates when policies or threats change.

Whalemate’s reading is that role-based segmentation stops being a maturity bonus and becomes the most defensible way to comply. If control 6.3 itself requires awareness, education, and training to be relevant to the job function, giving finance, development, help desk, and leadership the same material reduces traceability between risk, content, and behavioral expectation.

Who needs to be included, and where do organizations usually fail?

ISO27001.com, ISMS.online, and TCSA agree that scope is not limited to permanent employees. According to those sources, contractors, temporary staff, embedded third parties, interns, and outsourced staff under the organization’s control must be included.

Whalemate’s reading is that a frequent practical failure is not content but population coverage. TCSA proposes reconciling HR and procurement lists to avoid side doors into access, and that recommendation points to a concrete operational compliance problem: people with access to systems who never entered the awareness and policy acknowledgment workflow.

When should awareness start, before or after access?

TCSA says the security baseline should be a day-one step, with a short session or module plus policy acknowledgment completed before system access is granted, and access blocked until that acknowledgment is received. UpGuard recommends the same, saying every new employee should complete training before receiving access and that each role change should trigger a review of additional needs.

Whalemate’s reading is that the right trigger is not the calendar, but the operational event. Onboarding, role change, expanded privileges, and exposure to sensitive data are better triggers for maintaining evidence and reducing the risk window than waiting for the next annual course.

Are awareness and competence the same thing?

Qalea says clauses 7.2 and 7.3 create two complementary obligations: competence for the role and awareness of policy, contribution to the ISMS, and consequences of noncompliance. ISMS.online, in developing control 6.3, adds that the program must cover personal responsibilities, applicable rules, incident reporting, and points of contact for more information.

Whalemate’s reading is that awareness does not replace technical training, and technical training does not replace awareness. For IT and teams with specific responsibilities, defensible compliance requires combining general awareness with training aimed at concrete tasks, such as secure development, access management, or vulnerability handling, as UpGuard recommends for technical teams.

What decision does this enable for CISOs, IT, and compliance in LATAM?

The decision is not whether to provide awareness, because ISO/IEC 27001:2022 clause 7.3 and control 6.3 already make the practice mandatory, and PCI DSS 12.6 also requires a security awareness program, not a standalone course, according to the material provided. The decision is how to separate a scheme that only closes an audit from one that also helps manage human risk.

Whalemate’s reading is to implement two different dashboards. One for compliance, with population coverage, contractors included, policy acknowledgment, training before access, and triggers for hire or role changes, supported by TCSA, ManageEngine, and UpGuard practices. And another for behavior, with clicks, simulated and real phishing reports, and reduced compromise, using the metrics tracked by NIST and the recency and continuity signals reported by Keepnet Labs and Verizon.

Operational consequence for CISOs, IT, and compliance

For a LATAM team that has to decide tomorrow, the defensible model is to treat ISO 27001 awareness training as a continuous, segmented, measurable program, not as a uniform annual campaign. According to UpGuard, the annual minimum is only the floor, and according to Aviso Consultancy, control 6.3 requires regular updates aligned to job function.

Operationally, that means separating compliance evidence from risk-reduction evidence. Compliance includes full coverage by population, onboarding before access, review after role changes, completion records, and policy acknowledgment, according to TCSA, ManageEngine, and SoSafe. Behavior includes clicks, simulated and real phishing reports, and reduction in compromise, according to NIST, Verizon, and Keepnet Labs. If context is modeled, simulations are run, training is delivered, and interventions are prioritized using combined signals, the program stops being just training and becomes human risk management.

What to read next?

• Compliance on the platform