Evidence
Awareness training that is evidence rather than theatre
Every framework expects people to be aware of their responsibilities. Most organisations satisfy it with an annual video and a completion export.
Facts checked — 2026-09-11
What does awareness training have to evidence?
The standard asks for competence and awareness appropriate to the role, with records. That means role-specific content where the role matters — developers on secure development, support staff on handling customer data, everybody on reporting an incident — rather than one generic module for the whole company.
Records need to cover joiners too. The commonest finding here is not that training does not happen; it is that it happens every January and somebody who joined in March has no record until the following year.
The bottom line
Tie it to onboarding as well as to the annual cycle. The gap between the two is where the finding lives.
Related services
ISO/IEC 27001 — Information Security Management
Build an information security management system that survives Stage 2 — and the three years of surveillance that follow.
Related insights
Evidence
Running an internal audit that is worth the day it costs
Its job is to find things before the external auditor does, not to pass.
Evidence
Corrective action is not the same as fixing it
A fix addresses the instance. Corrective action addresses why it happened.
Evidence
Evidence that collects itself
If producing evidence is a separate task, it will be skipped in a busy quarter.