Competence

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization must decide what competence is needed by people working under its control whose work affects information security performance; make sure they are competent through education, training or experience; where applicable act to acquire the competence and check those actions worked; and keep documented evidence of competence. The note gives examples such as training, mentoring or reassigning current staff, or hiring or contracting competent people.

How the 2020 guidance taught the audit

Auditors confirm that the organization has determined who, under its control, does work that affects information security performance, what knowledge and skills those people need to achieve the intended results and their ability to apply them; that these people are competent through suitable education, training or experience; and that where needed it acts to acquire the competence and evaluates whether those actions worked. The clause reaches beyond employees to anyone working under the organization's control, such as contractors and volunteers, but evidence sought from third parties is limited to the roles and activities they perform for the ISMS organization.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

No substantive change. The clause still requires competence, the determination of needs, the action taken and the evidence.

Evidence an auditor asks for

• CompetenceRole and responsibility definitions and job descriptions for security-relevant work
• CompetenceStatement of competence required per role
• CompetenceEducation and training records and certifications
• CompetenceRecords of actions taken to close competence gaps and of their effectiveness evaluation

The questions an auditor will ask

Ask for the competence record of the person who runs a control and for the evidence that the competence was applied.

Common gaps

• Competence requirements defined for employees only, not for contractors under the organization's control
• Training attended but its effectiveness never evaluated
• No record of the competence required for a role, so gaps cannot be found

Prepare before the next audit

Keep a competence matrix per ISMS role, with the evidence and the review date.

Cross-references

7.3 7.4