Back to all 93 controls
Annex A 6.3
People
A.6.3 Information security awareness, education and training
Staff are aware and competent.
What good looks like
Mandatory induction training, refresher training, role-based modules, phishing simulations.
Evidence an auditor will ask for
Training records, completion rates, phishing campaign results.
Document template for this control
The Human Resources Security Policy template gives you auditor-ready wording that fulfils Annex A 6.3. Preview the full document before you download the editable version.